bin/60150: named(8) crashes at startup on NetBSD/i386 11.0_RC2

["Izumi Tsutsui via gnats" <gnats-admin%NetBSD.org@localhost>]

>Number:         60150
>Category:       bin
>Synopsis:       named(8) crashes at startup on NetBSD/i386 11.0_RC2
>Confidential:   no
>Severity:       critical
>Priority:       medium
>Responsible:    bin-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Tue Mar 31 17:00:00 +0000 2026
>Originator:     Izumi Tsutsui
>Release:        NetBSD 11.0_RC2
>Organization:
>Environment:
System: NetBSD mirage 11.0_RC2 NetBSD 11.0_RC2 (GENERIC) #0: Wed Mar 4 21:02:00 UTC 2026 mkrepro%mkrepro.NetBSD.org@localhost:/usr/src/sys/arch/i386/compile/GENERIC i386
Architecture: i386
Machine: i386
>Description:
After upgrading my LAN DNS server machine from NetBSD/i386 10.1 to 11.0_RC2,
named(8) crashes right after startup.

The configuration itself appears to be valid:

- "named-checkconf /etc/named.conf" succeeds.
- zone files load successfully.
- "named -g -c /etc/named.conf" reaches "all zones loaded" and "running".

However, immediately after that, named aborts with an assertion failure in
liburcu:

---
assertion "!is_removal_owner(node)" failed: file "/usr/src/external/lgpl2/userspace-rcu/lib/liburcu-cds/../../dist/src/rculfhash.c", line 1097, function "_cds_lfht_add"
Abort (core dumped)
---

Also, "named-checkconf -z /etc/named.conf" aborts instead of reporting a
configuration/zone error.  Without "-z", named-checkconf succeeds.

This seems related to the known recent named/liburcu startup crash reports,
for example PR bin/59035 and PR/59571.
 https://gnats.netbsd.org/59035
 https://gnats.netbsd.org/59571

>How-To-Repeat:
1. Use NetBSD/i386 11.0_RC2.
2. Configure a normal authoritative/caching named setup with local zones.
3. Run:

   named-checkconf /etc/named.conf
   named-checkconf -z /etc/named.conf
   named -g -c /etc/named.conf

Observed results:

- named-checkconf without "-z" succeeds.
- named-checkconf -z aborts.
- named -g loads all zones, prints "running", then aborts.

Example output from "named -g -c /etc/named.conf":

---
01-Apr-2026 01:54:25.024 starting BIND 9.20.11 (Stable Release) <id:c6b2e31>
01-Apr-2026 01:54:25.024 running on NetBSD i386 11.0_RC2 NetBSD 11.0_RC2 (GENERIC) #0: Wed Mar  4 21:02:00 UTC 2026  mkrepro%mkrepro.NetBSD.org@localhost:/usr/src/sys/arch/i386/compile/GENERIC
01-Apr-2026 01:54:25.024 built with  '--enable-querytrace' '--enable-fixed-rrset'
01-Apr-2026 01:54:25.024 running as: named -g -c /etc/named.conf
01-Apr-2026 01:54:25.024 compiled by GCC 12.5.0
01-Apr-2026 01:54:25.024 compiled with OpenSSL version: OpenSSL 3.5.1 1 Jul 2025
01-Apr-2026 01:54:25.024 linked to OpenSSL version: OpenSSL 3.5.1 1 Jul 2025
01-Apr-2026 01:54:25.024 compiled with libuv version: 1.44.2
01-Apr-2026 01:54:25.024 linked to libuv version: 1.44.2
01-Apr-2026 01:54:25.024 compiled with liburcu version: 0.15.0
01-Apr-2026 01:54:25.024 compiled with zlib version: 1.3.1
01-Apr-2026 01:54:25.024 linked to zlib version: 1.3.1
01-Apr-2026 01:54:25.025 ----------------------------------------------------
01-Apr-2026 01:54:25.025 BIND 9 is maintained by Internet Systems Consortium,
01-Apr-2026 01:54:25.025 Inc. (ISC), a non-profit 501(c)(3) public-benefit 
01-Apr-2026 01:54:25.025 corporation.  Support and training for BIND 9 are 
01-Apr-2026 01:54:25.025 available at https://www.isc.org/support
01-Apr-2026 01:54:25.025 ----------------------------------------------------

 :

01-Apr-2026 01:54:25.093 zone 127.IN-ADDR.ARPA/IN: loaded serial 2007010100
01-Apr-2026 01:54:25.093 zone 1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa/IN: loaded serial 1999012100
01-Apr-2026 01:54:25.093 zone localdomain/IN: loaded serial 2010110700
01-Apr-2026 01:54:25.093 zone 20.168.192.in-addr.arpa/IN: loaded serial 2019010100
01-Apr-2026 01:54:25.094 zone localhost/IN: loaded serial 1999012100
01-Apr-2026 01:54:25.094 all zones loaded
01-Apr-2026 01:54:25.094 FIPS mode is disabled
01-Apr-2026 01:54:25.094 running
assertion "!is_removal_owner(node)" failed: file "/usr/src/external/lgpl2/userspace-rcu/lib/liburcu-cds/../../dist/src/rculfhash.c", line 1097, function "_cds_lfht_add"
Abort (core dumped)
---

Example output from "named-checkconf -z /etc/named.conf":
---
zone localhost/IN: loaded serial 1999012100
zone 127.IN-ADDR.ARPA/IN: loaded serial 2007010100
zone 1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa/IN: loaded serial 1999012100
zone localdomain/IN: loaded serial 2010110700
zone 20.168.192.in-addr.arpa/IN: loaded serial 2019010100
/usr/src/external/mpl/bind/lib/libisc/../../dist/lib/isc/mem.c:653: INSIST(_refs == 1) failed, back trace
0xb4ffd00f <isc_assertion_typetotext+0x7c> at /usr/lib/libisc.so.23
0xb4ffcf63 <isc_assertion_failed+0x33> at /usr/lib/libisc.so.23
0xb4ffae82 <isc__mem_destroy+0xdf> at /usr/lib/libisc.so.23
0x8c9aad <main+0x8a11dd> at /usr/sbin/named-checkconf
Abort (core dumped)
---


>Fix:
Unknown.

---
Izumi Tsutsui