kern/50323: crashes with rarpd running

[martin%NetBSD.org@localhost]

>Number:         50323
>Category:       kern
>Synopsis:       crashes with rarpd running
>Confidential:   no
>Severity:       serious
>Priority:       high
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Fri Oct 09 19:00:00 +0000 2015
>Originator:     Martin Husemann
>Release:        NetBSD 7.99.21
>Organization:
The NetBSD Foundation, Inc.
>Environment:
System: NetBSD seven-days-to-the-wolves.aprisoft.de 7.99.21 NetBSD 7.99.21 (GENERIC) #27: Fri Oct 9 18:24:56 CEST 2015 martin%seven-days-to-the-wolves.aprisoft.de@localhost:/ssd/src/sys/arch/amd64/compile/GENERIC amd64
Architecture: x86_64
Machine: amd64
>Description:

I needed to netboot an old sun machine (old firmware, so boot net:dhcp would
not work). To help that I fired up rarpd on an arbitrary amd64 machine.
There is another machine running dhcpd, tftpd and serving nfs root for the
client.

Booting the kernel works, but as soon as the sun machine goes up to multiuser,
the machine running rarpd crashes (I guess once userland initializes the
interface previously used for booting).

(gdb) bt
#0  0xffffffff801196a5 in cpu_reboot (howto=howto@entry=260, 
    bootstr=bootstr@entry=0x0) at ../../../../arch/amd64/amd64/machdep.c:671
#1  0xffffffff8080f454 in vpanic (
    fmt=0xffffffff80d33c40 "kernel %sassertion \"%s\" failed: file \"%s\", line %d ", ap=ap@entry=0xfffffe8080007e90) at ../../../../kern/subr_prf.c:342
#2  0xffffffff80a836c3 in kern_assert (
    fmt=fmt@entry=0xffffffff80d33c40 "kernel %sassertion \"%s\" failed: file \"%s\", line %d ") at ../../../../../../lib/libkern/kern_assert.c:51
#3  0xffffffff808cac1b in in_arpinput (m=0xfffffe81079d9400, 
    m@entry=0xfffffe81288fd400) at ../../../../netinet/if_arp.c:1332
#4  0xffffffff808cc87c in arpintr () at ../../../../netinet/if_arp.c:1041
#5  0xffffffff807e8c78 in softint_execute (l=<optimized out>, s=4, 
    si=0xffff800048540230) at ../../../../kern/kern_softint.c:589
#6  softint_dispatch (pinned=<optimized out>, s=4)
    at ../../../../kern/kern_softint.c:871
#7  0xffffffff8011412f in Xsoftintr ()
(gdb) p panicstr
$1 = 0xffffffff811b0540 <scratchstr> "kernel diagnostic assertion \"(la->la_flags & LLE_STATIC) == 0\" failed: file \"../../../../netinet/if_arp.c\", line 1332 "
(gdb) p *la  
$2 = {lle_next = {le_next = 0x0, le_prev = 0xfffffe8107fa6628}, r_l3addr = {
    addr4 = {s_addr = 1013950656}, addr6 = {__u6_addr = {
        __u6_addr8 = "ˬo<", '\000' <repeats 11 times>, __u6_addr16 = {43200, 
          15471, 0, 0, 0, 0, 0, 0}, __u6_addr32 = {1013950656, 0, 0, 0}}}}, 
  ll_addr = {mac_aligned = 255762425307136, mac16 = {57344, 21633, 59549}, 
    mac8 = "\000\340\201T\235è", '\000' <repeats 13 times>}, spare0 = 0, 
  spare1 = 0, lle_tbl = 0xfffffe810800dbf0, lle_head = 0xfffffe8107fa6628, 
  lle_free = 0xffffffff805383ec <in_lltable_destroy_lle>, la_hold = 0x0, 
  la_numheld = 0, la_expire = 361, la_flags = 8270, la_asked = 0, 
  la_preempt = 0, ln_byhint = 0, ln_state = 0, ln_router = 0, ln_ntick = 0, 
  lle_refcnt = 1, lle_chain = {le_next = 0x0, le_prev = 0x0}, lle_timer = {
    _c_store = {0x0, 0x0, 0x0, 0x0, 0xffffffff811aad00 <callout_cpu0>, 
      0x10000000000, 0x11deeba1, 0x0, 0x0, 0x0}}, lle_lock = {
    rw_owner = 18446742429805761572}, la_rt = 0xfffffe813acf9de0, 
  la_opaque = 0x0}
(gdb) p *rt
$3 = {rt_nodes = {{rn_mklist = 0x0, rn_p = 0xfffffe813acf9e10, rn_b = -1, 
      rn_bmask = 0 '\000', rn_flags = 4 '\004', rn_u = {rn_leaf = {
          rn_Key = 0xfffffe81239908b0 "\020\002", rn_Mask = 0x0, 
          rn_Dupedkey = 0x0}, rn_node = {rn_Off = 597231792, rn_L = 0x0, 
          rn_R = 0x0}}}, {rn_mklist = 0x0, rn_p = 0xfffffe813c464148, 
      rn_b = 59, rn_bmask = 16 '\020', rn_flags = 4 '\004', rn_u = {rn_leaf = {
          rn_Key = 0x7 <error: Cannot access memory at address 0x7>, 
          rn_Mask = 0xfffffe813c464118 "", rn_Dupedkey = 0xfffffe813acf9de0}, 
        rn_node = {rn_Off = 7, rn_L = 0xfffffe813c464118, 
          rn_R = 0xfffffe813acf9de0}}}}, rt_gateway = 0xfffffe8123990888, 
  rt_flags = 3077, rt_refcnt = 1, rt_use = 3, rt_ifp = 0xffff800007447008, 
  rt_ifa = 0xfffffe813e2d7a50, rt_ifa_seqno = 0, 
  rt_llinfo = 0xfffffe813698a8c8, rt_rmx = {rmx_locks = 0, rmx_mtu = 0, 
    rmx_hopcount = 0, rmx_recvpipe = 0, rmx_sendpipe = 0, rmx_ssthresh = 0, 
    rmx_rtt = 0, rmx_rttvar = 0, rmx_expire = 2023, rmx_pksent = 699}, 
  rt_gwroute = 0x0, rt_timer = {lh_first = 0x0}, rt_parent = 0x0, 
  _rt_key = 0xfffffe81239908b0, rt_tag = 0x0}

(internal note: this is seven, /var/crash/netbsd.11.*)

>How-To-Repeat:
s/a

>Fix:
n/a