bin/51720: tcpdump uses 100% CPU

[gson%gson.org@localhost (Andreas Gustafsson)]

>Number:         51720
>Category:       bin
>Synopsis:       tcpdump uses 100% CPU
>Confidential:   no
>Severity:       non-critical
>Priority:       medium
>Responsible:    bin-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Thu Dec 15 17:35:00 +0000 2016
>Originator:     Andreas Gustafsson
>Release:        NetBSD 7.0
>Organization:

>Environment:
System: NetBSD
Architecture: x86_64
Machine: amd64
>Description:

While debugging #51531, I started the following simple tcpdump command
at the server end of the dedicated network used for the test:

  tcpdump -n -i re0

The following day, I noticed that the tcpdump process (29583) was
consuming close to 100% CPU.  Running "sudo ktruss -p 29583" showed an
endless high-speed stream of

 29583      1 tcpdump  read(0x3, 0x7f7ff7b16000, 0x80000) Err#35 EAGAIN
 29583      1 tcpdump  read(0x3, 0x7f7ff7b16000, 0x80000) Err#35 EAGAIN
 29583      1 tcpdump  read(0x3, 0x7f7ff7b16000, 0x80000) Err#35 EAGAIN
 29583      1 tcpdump  read(0x3, 0x7f7ff7b16000, 0x80000) Err#35 EAGAIN
 29583      1 tcpdump  read(0x3, 0x7f7ff7b16000, 0x80000) Err#35 EAGAIN
 29583      1 tcpdump  read(0x3, 0x7f7ff7b16000, 0x80000) Err#35 EAGAIN
 29583      1 tcpdump  read(0x3, 0x7f7ff7b16000, 0x80000) Err#35 EAGAIN
 29583      1 tcpdump  read(0x3, 0x7f7ff7b16000, 0x80000) Err#35 EAGAIN
 
The last stdout output from the tcpdump process itself was from about
five hours earlier, presumably because there had actually been no
traffic since then on the network in case.

After killing and restarting tcpdump, running ktruss -p against the
new tcpdump process, the output showed a much more reasonable once-per
second polling:

 18798      1 tcpdump  read(0x3, 0x7f7ff7b16000, 0x80000) = 0
       ""
 18798      1 tcpdump  read(0x3, 0x7f7ff7b16000, 0x80000) = 0
       ""

So something had caused tcpdump to go into a state of continuous
polling, but I don't know what.  Maybe the passage of time, maybe
the passage of a long time without traffic, maybe something else
entirely.

>How-To-Repeat:

Don't know - it has only happened once so far.

>Fix: