The following reply was made to PR kern/47506; it has been noted by GNATS.
From: Quentin Garnier <cube%cubidou.net@localhost>
To: gnats-bugs%NetBSD.org@localhost
Cc: tech-net%netbsd.org@localhost
Subject: re: kern/47506
Date: Fri, 2 May 2014 03:16:43 +0000
Hi,
It seems to me there is a race between tap_start() and tap_dev_poll().
The splx() call in tap_dev_poll() needs to be moved after the call to
selrecord().
However, I'm not entirely certain how that interacts with the spin
mutex that protects the selrecord() call.