The trick lies here. The call of disable_ipv6_foward is well choosen.
You already mentioned it: The order the atexit-registered functions are executed is reverse their registration (FILO).
In the function *disable_ipv6_foward()* the *restore_ipv6_forward()* is been registered with **atexit()**.
Below, *disable_ip_forward()* is _always_ called which registers *restore_ip_forward()* and *regain_privs_atexit()*.
So the call order of **atexit** would be:
1. *regain_privs_atexit();*
2. *restore_ip_forward();*
3. *restore_ipv6_forward();* (if compiled on one of the supported OSes)

So I saw no need to call it twice.