>Number:         17909
>Category:       kern
>Synopsis:       1.6BETA kernel panics in ipf while doing ipsec output
>Confidential:   no
>Severity:       critical
>Priority:       high
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sun Aug 11 00:53:01 PDT 2002
>Closed-Date:
>Last-Modified:
>Originator:     Michael van Elst
>Release:        NetBSD 1.6_BETA5 (CVS tree from 20020730)
>Organization:
-dis
>Environment:
System: NetBSD fud 1.6_BETA5 NetBSD 1.6_BETA5 (FUD) #10: Wed Jul 31 00:41:08 MEST 2002 src@fud:/d/0/src/sys/arch/i386/compile/FUD i386
Architecture: i386
Machine: i386
>Description:

A 1.6BETA system panics with

Kernel page fault, code 0
Stopped at fr_checkicmp6matchingstate+0x229      movzwl  0x2(%eax)

A kernel trace shows:

fr_checkicmp6matchingstate(c084afa8,c6d848a8,c6d8481c,c6d84814,0) at fr_checkicm
p6matchingstate+0x229
fr_checkstate(c084afa8,c6d848a8,c6d848a8,c0847700,c06cd6e0) at fr_checkstate+0x2
41
fr_check(c084afa8,28,c045b7e0,1,c6d84964) at fr_check+0x390
fr_check_wrapper6(0,c6d84964,c045b7e0,2,500) at fr_check_wrapper6+0x29
pfil_run_hooks(c0460f00,c6d849e0,c045b7e0,2,c6d84b14) at pfil_run_hooks+0x4c
ip6_output(c084af00,0,c6d84a28,4,0) at ip6_output+0xeaa
icmp6_reflect(c084af00,28,1,c6d84b74,2) at icmp6_reflect+0x3f6
icmp6_error(c084af00,1,1,0,c084afde) at icmp6_error+0x301
ipsec6_output_trans(c6d84c44,c084afde,c084af00,c06e5c00,0) at ipsec6_output_tran
s+0x100
ip6_output(c0847900,0,c07dd140,0,0) at ip6_output+0x46a
tcp_output(c06a7008,960,c0281f14,c06a7008) at tcp_output+0x10d5
tcp_timer_rexmt(c06a7008,c6d84e00,c0677000,1) at tcp_timer_rexmt+0x1bd
softclock(0,c6d84df4.,c0317bdd,c6d84e00) at softclock+0x161
softintr_dispatch(0) at softintr_dispatch+0x99
Xsoftclock() at Xsoftclock+0x11
--- interrupt ---
idle(c6d73ad4,c6d84f78,1f,1f) at idle+0x1b
bpendtsleep(c6d86020,128,c03a8490,0,0,c6d84f78,c6d84f40,c0204317) at bpendtsleep
sigsupsend1(c6d73ad4,c6d84f30,10,287,c6d84f80) at sigsuspend1+0x106
sys___sigsupsend14(c6d73ad4,c6d84f80,c6d84f78,c02e4bbf) at sys___sigsupsend14+0x
3c
syscall_plain(1f,1f,1f,1f,bfbfdbf0) at syscall_plain+0xa7


This is the third time the machine paniced exactly at the same place,
always with similar kernel traces. The first time this happened
the machine was running 1.6BETA1.



>How-To-Repeat:
	
>Fix:
	
>Release-Note:
>Audit-Trail:
>Unformatted: