Hi!

Never seen this one before:
panic: tcp_output REXMT

I have a core dump and a corresponding kernel with symbols if
someone wants to look at it.

(gdb) target kcore netbsd.core
panic: tcp_output REXMT
#0  0x00000000 in ?? ()
(gdb) bt
#0  0x00000000 in ?? ()
#1  0xc05b9000 in ?? ()
#2  0xc031999d in cpu_reboot (howto=260, bootstr=0x0)
    at /disk/wd1a/archive/cvs/src/sys/arch/i386/i386/machdep.c:752
#3  0xc0248f21 in db_reboot_cmd (addr=1, have_addr=0, count=-1070165970, 
    modif=0xcb133c58 "ÀXMÀo<\023Ë\001")
    at /disk/wd1a/archive/cvs/src/sys/ddb/db_command.c:694
#4  0xc0248a67 in db_command (last_cmdp=0xc046de18, cmd_table=0xc03ea080)
    at /disk/wd1a/archive/cvs/src/sys/ddb/db_command.c:469
#5  0xc024877a in db_command_loop ()
    at /disk/wd1a/archive/cvs/src/sys/ddb/db_command.c:260
#6  0xc024b880 in db_trap (type=1, code=0)
    at /disk/wd1a/archive/cvs/src/sys/ddb/db_trap.c:101
#7  0xc0317182 in kdb_trap (type=1, code=0, regs=0xcb133e9c)
    at /disk/wd1a/archive/cvs/src/sys/arch/i386/i386/db_interface.c:226
#8  0xc0321727 in trap (frame=0xcb133e9c)
    at /disk/wd1a/archive/cvs/src/sys/arch/i386/i386/trap.c:310
#9  0xc0102cc7 in calltrap ()
#10 0xc0294829 in panic (fmt=0xc040baca "tcp_output REXMT")
    at /disk/wd1a/archive/cvs/src/sys/kern/subr_prf.c:228
#11 0xc0119f4d in tcp_setpersist (tp=0xc15cb324)
    at /disk/wd1a/archive/cvs/src/sys/netinet/tcp_output.c:1567
#12 0xc011da7d in tcp_timer_persist (arg=0xc15cb324)
    at /disk/wd1a/archive/cvs/src/sys/netinet/tcp_timer.c:518
#13 0xc028d452 in softclock (v=0x0)
    at /disk/wd1a/archive/cvs/src/sys/kern/kern_timeout.c:387
#14 0xc0314b84 in softintr_dispatch (which=0)
    at /disk/wd1a/archive/cvs/src/sys/arch/x86/x86/softintr.c:104
(gdb) fr 11
#11 0xc0119f4d in tcp_setpersist (tp=0xc15cb324)
    at /disk/wd1a/archive/cvs/src/sys/netinet/tcp_output.c:1567
1567                    panic("tcp_output REXMT");
(gdb) l -
1557            return (0);
1558    }
1559
1560    void
1561    tcp_setpersist(struct tcpcb *tp)
1562    {
1563            int t = ((tp->t_srtt >> 2) + tp->t_rttvar) >> (1 + 2);
1564            int nticks;
1565
1566            if (TCP_TIMER_ISARMED(tp, TCPT_REXMT))
(gdb) l
1567                    panic("tcp_output REXMT");
1568            /*
1569             * Start/restart persistance timer.
1570             */
1571            if (t < tp->t_rttmin)
1572                    t = tp->t_rttmin;
1573            TCPT_RANGESET(nticks, t * tcp_backoff[tp->t_rxtshift],
1574                TCPTV_PERSMIN, TCPTV_PERSMAX);
1575            TCP_TIMER_ARM(tp, TCPT_PERSIST, nticks);
1576            if (tp->t_rxtshift < TCP_MAXRXTSHIFT)
(gdb) p tp
$1 = (struct tcpcb *) 0xc15cb324
(gdb) p *tp
$2 = {t_family = 2, segq = {tqh_first = 0x0, tqh_last = 0xc15cb328},
  t_segqlen = 0, t_timer = {{c_list = {cq_next = {elem = 0xc04b6b20,
          list = 0xc04b6b20}, cq_prev = {elem = 0xc046d790,
          list = 0xc046d790}}, c_func = 0xc011d6d4 <tcp_timer_rexmt>,
      c_arg = 0xc15cb324, c_time = 973423, c_flags = 2}, {c_list = {cq_next = {
          elem = 0xc046d790, list = 0xc046d790}, cq_prev = {elem = 0xc04b6b20,
          list = 0xc04b6b20}}, c_func = 0xc011da10 <tcp_timer_persist>,
      c_arg = 0xc15cb324, c_time = 973273, c_flags = 0}, {c_list = {cq_next = {
          elem = 0xc04b5bd8, list = 0xc04b5bd8}, cq_prev = {elem = 0xc166538c,
          list = 0xc166538c}}, c_func = 0xc011db0c <tcp_timer_keep>,
      c_arg = 0xc15cb324, c_time = 1693273, c_flags = 2}, {c_list = {
        cq_next = {elem = 0x0, list = 0x0}, cq_prev = {elem = 0x0,
          list = 0x0}}, c_func = 0xc011dca0 <tcp_timer_2msl>,
      c_arg = 0xc15cb324, c_time = 0, c_flags = 0}}, t_state = 4,
  t_rxtshift = 0, t_rxtcur = 3, t_dupacks = 0, t_partialacks = -1,
  t_peermss = 1460, t_ourmss = 1460, t_segsz = 512, t_force = 0 '\0',
  t_flags = 2048, t_template = 0xc1401300, t_inpcb = 0xc15be294,
  t_in6pcb = 0x0, t_delack_ch = {c_list = {cq_next = {elem = 0xc046d790,
        list = 0xc046d790}, cq_prev = {elem = 0xc04b6b20, list = 0xc04b6b20}},
    c_func = 0xc011d5b4 <tcp_delack>, c_arg = 0xc15cb324, c_time = 949143,
    c_flags = 0}, snd_una = 3822952869, snd_nxt = 3822954405,
  snd_up = 3822952869, snd_wl1 = 1278585372, snd_wl2 = 3822952869,
  iss = 3822192177, snd_wnd = 13936, snd_recover = 3822192177,
  snd_high = 3822952869, rcv_wnd = 33580, rcv_nxt = 1278585372,
  rcv_up = 1278585372, irs = 1278584748, rcv_adv = 1278618952,
  snd_max = 3822954405, snd_cwnd = 1961, snd_ssthresh = 1024,
  t_rcvtime = 19455, t_rtttime = 19455, t_rtseq = 3822952869, t_srtt = 26,
  t_rttvar = 8, t_rttmin = 2, max_sndwnd = 17520, t_oobflags = 0 '\0',
  t_iobc = 0 '\0', t_softerror = 0, snd_scale = 0 '\0', rcv_scale = 0 '\0',
  request_r_scale = 0 '\0', requested_s_scale = 0 '\0', ts_recent = 0,
  ts_recent_age = 0, ts_timebase = 16750, last_ack_sent = 1278585372,
  rcv_sack_flags = 0 '\0', rcv_dsack_block = {left = 0, right = 0}, timeq = {
    tqh_first = 0x0, tqh_last = 0xc15cb454}, snd_holes = {tqh_first = 0x0,
    tqh_last = 0xc15cb45c}, snd_numholes = 0, rcv_lastsack = 3822285061,
  sack_newdata = 0, snd_fack = 3822952869, t_sc = {lh_first = 0x0},
  t_lastm = 0xc1401900, t_inoff = 436, t_lastoff = 1024, t_lastlen = 512,
  t_mtudisc = 0, t_pmtud_mss_acked = 7300, t_pmtud_mtu_sent = 1500,
  t_pmtud_th_seq = 0, t_pmtud_nextmtu = 0, t_pmtud_ip_len = 0,
  t_pmtud_ip_hl = 0}

Any ideas?

Let me know what else you need.
 Thomas