carp: fix regression panic from ccd69bd573

Reported & tested by:	Oleg Ginzburg <olevole olevole.ru>
Fixes:			ccd69bd573

sys/netinet6/nd6_nbr.c

@@ -514,7 +514,8 @@ nd6_ns_output_fib(struct ifnet *ifp, const struct in6_addr *saddr6,
 			 * Do not send NS for CARP address if we are not
 			 * the CARP master.
 			 */
-			if (ifa != NULL && !(*carp_master_p)(ifa)) {
+			if (ifa != NULL && ifa->ifa_carp != NULL &&
+			    !(*carp_master_p)(ifa)) {
 				log(LOG_DEBUG,
 				    "nd6_ns_output: NS from BACKUP CARP address %s\n",
 				    ip6_sprintf(ip6buf, &ip6->ip6_src));