kern/59675: pppoe crashes kernel

[sc.dying%gmail.com@localhost]

>Number:         59675
>Category:       kern
>Synopsis:       pppoe crashes kernel
>Confidential:   no
>Severity:       critical
>Priority:       high
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Mon Sep 29 07:05:00 +0000 2025
>Originator:     sc.dying%gmail.com@localhost
>Release:        NetBSD/amd64 11.0_BETA on 20250816163208Z
>Organization:
>Environment:
System: NetBSD  11.0_BETA NetBSD 11.0_BETA (GENERIC) #0: Sat Aug 16 16:32:08 UTC 2025 mkrepro%mkrepro.NetBSD.org@localhost:/usr/src/sys/arch/amd64/compile/GENERIC amd64 x86_64
Architecture: x86_64
Machine: amd64
>Description:
I'm trying to update my amd64 pppoe client to 11.0_BETA.
Before update userlands, I replace only kernel, reboot,
and start pppoe session. one sec later, kernel crashed.

(ifconfig pppoe0 up)
[ 829.0468355] panic: kernel diagnostic assertion "(kpreempt_disabled() || cpu_softintr_p() || ISSET(curlwp->l_pflag, LP_BOUND))" failed: file "/usr/src/sys/kern/subr_psref.c", line 344 passive references are CPU-local, but preemption is enabled and the caller is not in a softint or CPU-bound LWP
[ 829.0768346] cpu1: Begin traceback...
[ 829.0768346] vpanic() at netbsd:vpanic+0x171
[ 829.0768346] kern_assert() at netbsd:kern_assert+0x4b
[ 829.0868350] psref_release() at netbsd:psref_release+0x1b5
[ 829.0968348] sppp_ipcp_tlu() at netbsd:sppp_ipcp_tlu+0x212
[ 829.0968348] sppp_wq_work() at netbsd:sppp_wq_work+0x48
[ 829.1068354] workqueue_worker() at netbsd:workqueue_worker+0xfa
[ 829.1168350] cpu1: End traceback...

-current kernel on amd64 crashes, too.
But Raspberry PI 3b+ /w 11.99.3/earmv7hf does not.


>How-To-Repeat:
	Please see Description.
	As a PPPoE server I build 11.99.3/earmv7hf kernel with
	PPPOE_SERVER and run it on rpi3b+.

Server:
!pppoectl -e ure1 $int
!pppoectl $int \
	authproto=chap \
	myauthname=myname \
	myauthsecret=mysecret \
	hisauthproto=none
!ifconfig $int link0
inet 10.64.0.1 10.64.0.2 down

Client:
!pppoectl -e re1 $int
!pppoectl $int \
	authproto=chap \
	myauthname=myname \
	myauthsecret=mysecret \
	hisauthproto=none \
	query-dns=3 \
	max-auth-failure=3
inet 0.0.0.0 0.0.0.1


>Fix:
	Yes, please.