Fix null deref in mld_v1_transmit_report

After r337866 it is possible for an in_multi6 to be referenced while
mid teardown. Handle case of cleared ifnet pointer.

Reported by:	ae

sys/netinet6/mld6.c

@@ -1800,6 +1800,9 @@ mld_v1_transmit_report(struct in6_multi *in6m, const int type)
 	MLD_LOCK_ASSERT();
 	
 	ifp = in6m->in6m_ifp;
+	/* in process of being freed */
+	if (ifp == NULL)
+		return (0);
 	ia = in6ifa_ifpforlinklocal(ifp, IN6_IFF_NOTREADY|IN6_IFF_ANYCAST);
 	/* ia may be NULL if link-local address is tentative. */