In div_output() explicitly set m->m_nextpkt to NULL. If divert socket

is not userland, but ng_ksocket, then m->m_nextpkt may be non-NULL. In
this case we would panic in sbappend.

sys/netinet/ip_divert.c

@@ -277,7 +277,12 @@ div_output(struct socket *so, struct mbuf *m,
 	struct divert_tag *dt;
 	int error = 0;
 
+	/*
+	 * An mbuf may hasn't come from userland, but we pretend
+	 * that it has.
+	 */
 	m->m_pkthdr.rcvif = NULL;
+	m->m_nextpkt = NULL;
 
 	if (control)
 		m_freem(control);		/* XXX */