memory being modified on the freelist

[Brett Lymn <blymn%baesystems.com.au@localhost>]

I am posting this on behalf of someone else, they have a laptop
running a recent version of -current.  They use a dialup modem for
their internet connection and automatically load some ipf rules when
the ppp link comes up.  They have noticed that they get the following
messages coming up when the modem line drops out and reconnects:

------------------------------------------------------------------------
0 fred:staff@t61/~$ fgrep deadbeef /var/log/messages
Sep 15 20:20:38 t61 /netbsd: Data modified on freelist: word 0 of object 
0xffff800004684200 size 152 previous type bar (0x80bf0ca0 != 0xdeadbeef)
Sep 16 13:28:49 t61 /netbsd: Data modified on freelist: word 0 of object 
0xffff8000046b8200 size 256 previous type bar (0x803 != 0xdeadbeef)
Sep 16 17:21:16 t61 /netbsd: Data modified on freelist: word 0 of object 
0xffff800004c10300 size 172 previous type bar (0x80c01d60 != 0xdeadbeef)
Sep 16 19:59:30 t61 /netbsd: Data modified on freelist: word 0 of object 
0xffff800004ba4500 size 256 previous type bar (0x80bf0ca0 != 0xdeadbeef)

0 fred:staff@t61/~$ gzip -cd /var/log/messages.[0-2].gz | fgrep 0xdeadbeef
Sep 14 19:26:31 t61 /netbsd: Data modified on freelist: word 0 of object 
0xffff800004293600 size 176 previous type bar (0x80bf0ca0 != 0xdeadbeef)
Sep 15 03:27:23 t61 /netbsd: Data modified on freelist: word 0 of object 
0xffff800004593a00 size 176 previous type foo (invalid addr 0xdeadbeefdeadbeef)
Sep 15 03:27:23 t61 /netbsd: 0xdeadbeef)
Sep 15 08:56:09 t61 /netbsd: Data modified on freelist: word 0 of object 
0xffff800004587e00 size 176 previous type bar (0xd78c6752 != 0xdeadbeef)
Sep 10 22:21:50 t61 /netbsd: Data modified on freelist: word 0 of object 
0xffff800004298700 size 160 previous type bar (0x80bf0ca0 != 0xdeadbeef)
Sep 10 23:40:00 t61 /netbsd: Data modified on freelist: word 0 of object 
0xffff8000042a5300 size 176 previous type bar (0xfed44d0c != 0xdeadbeef)
Sep 11 07:41:00 t61 /netbsd: Data modified on freelist: word 0 of object 
0xffff80000446fc00 size 176 previous type foo (invalid addr 0xdeadbeefdeadbeef)
Sep 11 07:41:00 t61 /netbsd: Data modified on freelist: word 0 of object 
0xffff80000446fc00 size 176 previous type bar (0x80c01b20 != 0xdeadbeef)
Sep 12 08:54:18 t61 /netbsd: Data modified on freelist: word 0 of object 
0xffff80000470ad00 size 176 previous type bar (0x80c01d60 != 0xdeadbeef)
Sep  9 12:37:07 t61 /netbsd: Data modified on freelist: word 0 of object 
0xffff80000462c700 size 176 previous type bar (0x489c0280 != 0xdeadbeef)
Sep 10 10:36:21 t61 /netbsd: Data modified on freelist: word 0 of object 
0xffff8000047d8f00 size 176 previous type foo (invalid addr 0xdeadbeefdeadbeef)
Sep 10 10:36:21 t61 /netbsd: Data modified on freelist: word 0 of object 
0xffff8000047d8f00 size 176 previous type bar (0x80c01d60 != 0xdeadbeef)

Checking the types in the kernel shows:

0 fred:staff@t61/~$ nm /netbsd | fgrep 80bf0ca0
ffffffff80bf0ca0 D M_IPFILTER
0 fred:staff@t61/~$ nm /netbsd | fgrep 80c01b20
ffffffff80c01b20 D M_DEVBUF
0 fred:staff@t61/~$ nm /netbsd | fgrep 80c01d60
ffffffff80c01d60 D M_RTABLE
0 fred:staff@t61/~$ 

So it looks like something in the network stack is still referencing
memory after the link has gone down.  Anyone have ideas on how to work
out what?

-- 
Brett Lymn
"Warning:
The information contained in this email and any attached files is
confidential to BAE Systems Australia. If you are not the intended
recipient, any use, disclosure or copying of this email or any
attachments is expressly prohibited.  If you have received this email
in error, please notify us immediately. VIRUS: Every care has been
taken to ensure this email and its attachments are virus free,
however, any loss or damage incurred in using this email is not the
sender's responsibility.  It is your responsibility to ensure virus
checks are completed before installing any data sent in this email to
your computer."