kern/55489: Infinite loop in "rump.ifconfig bridge0 create"

[prlw1%cam.ac.uk@localhost]

>Number:         55489
>Category:       kern
>Synopsis:       Infinite loop in "rump.ifconfig bridge0 create"
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Tue Jul 14 10:55:00 +0000 2020
>Originator:     Patrick Welche
>Release:        NetBSD-9.99.69/amd64
>Organization:
>Environment:
>Description:
As per

 http://mail-index.netbsd.org/current-users/2020/07/14/msg039137.html

but checked on 9.99.69, in one xterm:
                                            
$ rump_allserver -sv unix:///tmp/sock         
                                                
in another xterm:                               
                                                  
$ export RUMP_SERVER=unix:///tmp/sock               
$ rump.ifconfig -a                                    
lo0: flags=0x8049<UP,LOOPBACK,RUNNING,MULTICAST> mtu 33624
        inet 127.0.0.1/8 flags 0
        inet6 ::1/128 flags 0x20<NODAD>
        inet6 fe80::1%lo0/64 flags 0 scopeid 0x1
$ rump.ifconfig bridge0 create
                                          
and watch rump_allserver's cpu use hit 100% (!)

We seem to be stuck in

  https://nxr.netbsd.org/xref/src/sys/net/if.c#1684

(gdb) n
1684                    if (strcmp(ifname + 3, ifc->ifc_name) == 0)
(gdb) print *ifc
$11 = {ifc_list = {le_next = 0x7ecb26c0b3c0 <rumpns_ipsec_cloner>, 
    le_prev = 0x7ecb24003260 <rumpns_virt_cloner>}, 
  ifc_name = 0x7ecb25203d20 "shmif", ifc_namelen = 5, 
  ifc_create = 0x7ecb25202acb <shmif_clone>, 
  ifc_destroy = 0x7ecb252026f7 <shmif_unclone>}
(gdb) n
1684                    if (strcmp(ifname + 3, ifc->ifc_name) == 0)
...
(gdb) n
1684                    if (strcmp(ifname + 3, ifc->ifc_name) == 0)
(gdb) print *ifc
$24 = {ifc_list = {le_next = 0x7ecb26c0b3c0 <rumpns_ipsec_cloner>, 
    le_prev = 0x7ecb24003260 <rumpns_virt_cloner>}, 
  ifc_name = 0x7ecb25203d20 "shmif", ifc_namelen = 5, 
  ifc_create = 0x7ecb25202acb <shmif_clone>, 
  ifc_destroy = 0x7ecb252026f7 <shmif_unclone>}

shmif again?! And "bridge" doesn't appear in the list, so we don't break out of the apparently infinite list.

# ifconfig bridge0 create

outside of rump works.
>How-To-Repeat:

>Fix: