On Mon, May 07, 2007 at 11:34:37AM +0200, 6bone@6bone.informatik.uni-leipzig.de wrote:
> hello,
> 
> now I can offer a complete trace with a matching netbsd.gdb
> 
> http://139.18.25.35/dump1.jpg
> http://139.18.25.35/netbsd.gdb

Try a kernel with the following patch:

Index: fil.c
===================================================================
RCS file: /home/pavel/cvs/src/sys/dist/ipf/netinet/fil.c,v
retrieving revision 1.11.2.2
diff -u -p -c -r1.11.2.2 fil.c
cvs diff: conflicting specifications of output style
*** fil.c	13 May 2006 16:52:52 -0000	1.11.2.2
--- fil.c	8 May 2007 18:11:22 -0000
*************** int plen;
*** 831,836 ****
--- 831,838 ----
  		if (M_LEN(fin->fin_m) < plen) {
  			if (fr_pullup(fin->fin_m, fin, plen) == NULL)
  				return -1;
+ 			if (M_LEN(fin->fin_m) < plen)
+ 				printf("frpr_pullup: fr_pullup malfunction, expect panic soon\n");
  		}
  	}
  #endif

I am curious if it will print the message before panicing.