Using this in our system:
kern.osrelease = 6.5.0
kern.version = 2012/06/20-13:49:31EDT

If the io-pkt gets an ICMP request to a host for which there is no specific route, the packet is sent to the default 
gateway. So far so good. But, when the route for the relevant subnet for that host is later added to the route table, 
ICMP requests keep on being routed to the default gateway.
Once we enter this situation, the only way we have so far found for getting rid of this undesired caching is to remove 
and reinstall the default route, which is not a very nice thing to do.
First we thought this was due to the fast forwarding feature, but we realized by code reading that ICMP is not supposed 
to create IP flows. Further, we tried, while in the "error" situation, sending ICMP requests with different TOS values, 
but all requests got still routed to the default gateway.
We also tried disabling the fast forwarding altogether (hopefully), by setting net.inet.ip.maxflows = 0. The behavior 
did not change.

Is there anyone that can explain why this behavior and how to overcome it?
Thanks.