kern/38759: panic with ifconfig tap0 destroy

[njoly%pasteur.fr@localhost]

>Number:         38759
>Category:       kern
>Synopsis:       panic with ifconfig tap0 destroy
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Mon May 26 12:15:00 +0000 2008
>Originator:     Nicolas Joly
>Release:        NetBSD 4.99.63
>Organization:
Biological Software and Databanks.
Institut Pasteur, Paris.
>Environment:
System: NetBSD lanfeust.sis.pasteur.fr 4.99.63 NetBSD 4.99.63 (LANFEUST) #12: 
Mon May 26 11:25:05 CEST 2008 
njoly%lanfeust.sis.pasteur.fr@localhost:/local/src/NetBSD/obj.amd64/sys/arch/amd64/compile/LANFEUST
 amd64
Architecture: x86_64
Machine: amd64
>Description:
Trying to destroy a newly created tap(4) interface makes the kernel panic.

root@lanfeust [~]# ifconfig tap0 create
root@lanfeust [~]# ifconfig tap0
tap0: flags=8802<BROADCAST,SIMPLEX,MULTICAST> mtu 1500
        address: f2:0b:a4:38:1c:07
        media: Ethernet autoselect
root@lanfeust [~]# ifconfig tap0 destroy
[PANIC]

kernel: page fault trap, code=0
Stopped in pid 8689.1 (ifconfig) at     netbsd:config_detach+0xe8:      cmpq 
$0,0x40(%rbx)
db{0}> bt  
config_detach() at netbsd:config_detach+0xe8
tap_clone_destroyer() at netbsd:tap_clone_destroyer+0x29
ifioctl() at netbsd:ifioctl+0x483
soo_ioctl() at netbsd:soo_ioctl+0x24c
sys_ioctl() at netbsd:sys_ioctl+0x134
syscall() at netbsd:syscall+0x9a

This is mostly a GENERIC+DIAGNOSTIC kernel (with a few other devices),
but with acpi disabled.

>How-To-Repeat:
ifconfig tap0 create
ifconfig tap0 destroy
>Fix:
n/a