Does antone know what the loop below in check_pty() is for?
(line 186 in tty_pty.c)

		simple_lock(&pt_softc_mutex);
		do {
			for(newnpty = npty; newnpty <= minor(dev);
				newnpty *= 2);

			if (newnpty > maxptys)
				newnpty = maxptys;
	
			simple_unlock(&pt_softc_mutex);
			newpt = ptyarralloc(newnpty);
			simple_lock(&pt_softc_mutex);

			if (maxptys == npty) {
				simple_unlock(&pt_softc_mutex);
				goto limit_reached;
			}
		} while (newnpty > maxptys);

AFAICT it just leaks memory (as the code does if it escapes on the goto).

I suspect it has something to do with ensuring that sysctl(kern.maxptys)
is honoured if it is reduced while the pt_softc_mutex isn't held.
However that isn't what the code does!

Something like:
	for(newnpty = npty; newnpty <= minor(dev)
		newnpty *= 2);
	if (newnpty > maxptys)
		newnpty = maxptys;
	newpt = ptyarralloc(newnpty);
	simple_lock(&pt_softc_mutex);
	if (newnpty > maxptys) {
		newnpty = maxptys;
		if (newnpty <= minor(dev)) {
			simple_unlock(&pt_softc_mutex);
			free(newpt, M_DEVBUF);
			goto limit_reached;
		}
	}

looks rather better.

	David

-- 
David Laight: david@l8s.co.uk