Subject: Re: kern/21189
To: None <tron@netbsd.org, netbsd-bugs@netbsd.org, gnats-admin@netbsd.org,>
From: None <tron@netbsd.org>
List: netbsd-bugs
Date: 03/11/2005 17:57:45
Synopsis: ifconfig + stf0 make kernel crash with uvm fault

State-Changed-From-To: open->analyzed
State-Changed-By: tron@netbsd.org
State-Changed-When: Fri, 11 Mar 2005 17:57:44 +0000
State-Changed-Why:
I can still reproduce the problem under NetBSD 2.99.16. Examining a crash
dump I found out that:

1.) The kernel crashes because it tries to use a "struct ifnet" which
    has been free()d before.

2.) The bogus "struct ifnet *" pointer comes from the ND prefix list
    which is walked in nd6_prefix_offlink() in line 1574-1603.