ip6_output: fix memory leak on fast-send

When emitting NDP Neighbour Sollicitations, ip6_output immediately calls
if_encap without going through any queue. if_encap however does not free
the mbuf, so ip6_output has to do it.

This was leaking one mbuf per NDP NS sent by slirp. Hopefully the guest was
not using more than NDP_TABLE_SIZE (16) IPv6 addresses, in which case it was
limited to a bound number, but more addresses would result to leaks.

src/ip6_output.c

diff --git a/src/ip6_output.c b/src/ip6_output.c
index b861106..2f62cc9 100644
--- a/src/ip6_output.c
+++ b/src/ip6_output.c
@@ -30,7 +30,10 @@
     ip->ip_fl_lo = 0;
 
     if (fast) {
+        /* We cannot fast-send non-multicast, we'd need a NDP NS */
+        assert(IN6_IS_ADDR_MULTICAST(&ip->ip_dst));
         if_encap(m->slirp, m);
+        m_free(m);
     } else {
         if_output(so, m);
     }