kern/50674: Kernel panics when altqd tries to manage packets on an interface that can be dettached

[joel.bertrand%systella.fr@localhost]

>Number:         50674
>Category:       kern
>Synopsis:       Kernel panics when altqd tries to manage packets on an interface that can be dettached
>Confidential:   no
>Severity:       critical
>Priority:       high
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Mon Jan 18 09:15:00 +0000 2016
>Originator:     BERTRAND Joël
>Release:        netbsd-7/HEAD (18th of jan, 2016 tree)
>Organization:
>Environment:
NetBSD legendre.systella.fr 7.0_STABLE NetBSD 7.0_STABLE (CUSTOM) #1: Sun Jan 10 12:53:36 CET 2016  root%legendre.systella.fr@localhost:/usr/obj/sys/arch/amd64/compile/CUSTOM amd64
>Description:
I have installed an OpenVPN client on a NetBSD client in level 2 configuration (tap). On this interface, I have configured altqd to assign high priority to SIP :

legendre# cat /etc/altq.conf
# wm0  : LAN
# wm1  : WAN
# tap0 : VPN
interface wm1 bandwidth 10M priq

class priq wm1 high_class NULL priority 1
class priq wm1 low_class NULL priority 0 default

filter wm1 high_class 0 1194 0 0 17
filter wm1 high_class 0 0 0 1194 17

interface tap0 bandwidth 2M priq

class priq tap0 high_class_vpn NULL priority 1
class priq tap0 low_class_vpn NULL priority 0 default

filter tap0 high_class_vpn 192.168.10.250 0 0 0 17
filter tap0 high_class_vpn 0 0 192.168.10.250 0 17

interface wm0 bandwidth 1000M priq

class priq wm0 high_class_lan NULL priority 1
class priq wm0 low_class_lan NULL priority 0 default

filter wm0 high_class_lan 192.168.10.250 0 0 0 17
filter wm0 high_class_lan 0 0 192.168.10.250 0 17

When OpenVPN server disappears, tap0 is detached and kernel panics.
>How-To-Repeat:
Configure altqd on an OpenVPN link (client side) and stop OpenVPN server.
>Fix:
Disable altqd or remove tap0 from /etc/altqd.conf, but it is not acceptable.