Looking back at my nsiproxy notes, I did partially reverse this one (mainly because it turns out to be table 0, so it was the first of the IP tables that I looked at).
For IPv4, the key is 8 UINTs long, with the dest addr in the 2nd UINT. I guess the NET_LUID would also be sent along with any src address (although we could leave those as undetermined for now). You'd want to call `NsiGetAllParameters()` and retrieve the `dynamic` table. It has the size of 26 UINTs: the prefix is in the 2nd, the prefix length in the 3rd, next hop is in the 11th. Many other properties can easily be found by comparing with the result of `GetBestRoute2()`. I'd suggest testing with localhost as well as a remote addr.
I didn't put much effort into IPv6, save that the key size is 14 UINTs i.e. 6 more than IPv4 (which makes sense if there are two addresses), and the dynamic table is 38 UINTs.
So with all that, it probably makes sense to implement this in `nsiproxy.sys`.