port-amd64/56844: delete auto-modified network route crash

[ocb@dc.localdomain]

>Number:         56844
>Category:       port-amd64
>Synopsis:       delete auto-modified network route crash
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    port-amd64-maintainer
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Wed May 18 14:00:00 +0000 2022
>Originator:     ocb@dc.localdomain
>Release:        NetBSD 9.2
>Organization:
	
>Environment:
	
	
System: NetBSD 9.2 (KERNEL1_KASLR) #0: Fri Jan 21 03:09:17 UTC 2022 kernel@dc:/usr/kernel/usr/src/sys/arch/amd64/compile/KERNEL1_KASLR amd64
Architecture: x86_64
Machine: amd64
>Description:
	The system uses IP .2 as default gateway, where IP .2 is behind a router IP .1. Connection works, everything is ok. To allow some additional virtual machines from different subnet access IP .2, a route 'route add 192.168.88.2 192.168.88.1' is added. Connection works, everything is ok.

dc# route -n show  | grep 192.168.88.2
default            192.168.88.2       UG          -        -      -  wm0
192.168.88/24      link#1             U           -        -      -  wm0
192.168.88.2       192.168.88.1       UGH         -        -      -  wm0
192.168.88.252     link#1             UHl         -        -      -  lo0
192.168.88.2       4c:5e:0c:b7:7e:08  UH          -        -      -  wm0

Now I decide to connect to IP .2 SSH port and the recently added route gets modified.

dc# route -n show  | grep 192.168.88.2
default            192.168.88.2       UG          -        -      -  wm0
192.168.88/24      link#1             U           -        -      -  wm0
192.168.88.2       192.168.88.2       UGH         -        -      -  wm0 <-- note this line
192.168.88.252     link#1             UHl         -        -      -  lo0
192.168.88.2       4c:5e:0c:b7:7e:08  UH          -        -      -  wm0

Finally if we try to remove this route by executing 'route delete 192.168.88.2 192.168.88.2', machine running KASLR kernel will be very limited, X continues to be visually responsive, already running terminal emulators can run commands but will hang and can not be paused or killed. New terminal emulators can not be started. Changing active virtual console will finally crash X and kernel. I am not experienced with crashes but this appears like memory is slowly getting corrupted. Kernel crash dump successfully gets saved to swap, but upon reboot is unable to retrieve it from swap. Note, crash dump saving and retrieving works fine on non-kaslr kernel, but not in this situation, since.. 

On a GENERIC (non-KASLR) kernel, the situation is different. After executing 'route delete' command, the system freezes instantly and requires hard poweroff on the button. No backtrace, no crash log. 

>How-To-Repeat:
	
>Fix:
	

>Unformatted: