Fix a (long standing?) bug in ip_output(): if ip_insertoptions() is

called and ip_output() encounters an error and bails (i.e. host
unreachable), we will leak an mbuf. This is because the code calls
m_freem(m0) after jumping to the bad: label at the end of the function,
when it should be calling m_freem(m). (m0 is the original mbuf list
_without_ the options mbuf prepended.)

Obtained from:	NetBSD

sys/netinet/ip_output.c

@@ -982,7 +982,7 @@ ip_output(m0, opt, ro, flags, imo)
 #endif /* IPSEC */
 	return (error);
 bad:
-	m_freem(m0);
+	m_freem(m);
 	goto done;
 }