kern/46697: netbsd6-beta2 crash

[6bone%6bone.informatik.uni-leipzig.de@localhost]

>Number:         46697
>Category:       kern
>Synopsis:       netbsd6-beta2 crash
>Confidential:   no
>Severity:       serious
>Priority:       high
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Fri Jul 13 06:10:00 +0000 2012
>Originator:     Uwe Toenjes
>Release:        netbsd6 beta2
>Organization:
University of Leipzig
>Environment:
NetBSD 6.0_BETA2 (amd64)
>Description:
the netbsd6-beta2 kernel sometimes crashes with:


fatal page fault in supervisor mode

trap type 6 code 0 rip ffffffff80300b91 cs 8 rflags 10202 cr2 20 cpl 4 rsp ffff 
fe8002dbb6d0
panic: trap
cpu0: Begin traceback...
printf_nolog() at netbsd:printf_nolog
startlwp() at netbsd:startlwp
alltraps() at netbsd:alltraps+0x9e
fr_checkicmp6matchingstate() at netbsd:fr_checkicmp6matchingstate+0xe8
fr_stlookup() at netbsd:fr_stlookup+0x813
fr_checkstate() at netbsd:fr_checkstate+0xa8
fr_check() at netbsd:fr_check+0x434
pfil_run_hooks() at netbsd:pfil_run_hooks+0x9d
ip6_input() at netbsd:ip6_input+0x718
ip6intr() at netbsd:ip6intr+0x77
softint_dispatch() at netbsd:softint_dispatch+0xd9
DDB lost frame for netbsd:Xsoftintr+0x4f, trying 0xfffffe8002dbbd70
Xsoftintr() at netbsd:Xsoftintr+0x4f

kernel dumps can be downloaded at

https://suse.uni-leipzig.de/netbsd.20.gz
https://suse.uni-leipzig.de/netbsd.20.core.gz

and

https://suse.uni-leipzig.de/netbsd.21.gz
https://suse.uni-leipzig.de/netbsd.21.core.gz

debug code is available at

https://suse.uni-leipzig.de/netbsd.gdb
https://suse.uni-leipzig.de/netbsd.map


the problem does not occur with a netbsd6-beta kernel
>How-To-Repeat:

>Fix: