kern/58720: Trap in arpintr

[gson%gson.org@localhost (Andreas Gustafsson)]

>Number:         58720
>Category:       kern
>Synopsis:       Trap in arpintr
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sun Oct 06 08:35:00 +0000 2024
>Originator:     Andreas Gustafsson
>Release:        NetBSD-current, source date 2024-07-01 17:47:24 Z
>Organization:
  
>Environment:
System: NetBSD
Architecture: i386
Machine: i386
>Description:

My NetBSD-current/i386 router/firewall/NAT machine paniced with a trap
in arpintr and left a crash dump.

  gusev /var/crash # gdb /netbsd
  [...]
  (gdb) target kvm netbsd.11.core
  0xc012ce85 in maybe_dump (howto=260) at /usr/src/sys/arch/i386/i386/machdep.c:725
  725			dumpsys();
  (gdb) bt
  #0  0xc012ce85 in maybe_dump (howto=260) at /usr/src/sys/arch/i386/i386/machdep.c:725
  #1  cpu_reboot (howto=howto@entry=260, bootstr=bootstr@entry=0x0) at /usr/src/sys/arch/i386/i386/machdep.c:746
  #2  0xc0c62338 in kern_reboot (howto=howto@entry=260, bootstr=bootstr@entry=0x0) at /usr/src/sys/kern/kern_reboot.c:91
  #3  0xc0ca74a9 in vpanic (fmt=fmt@entry=0xc11b224c "trap", ap=0xdbaf2d2c "\364-\257\333\364-\257\333\003") at /usr/src/sys/kern/subr_prf.c:288
  #4  0xc0ca755c in panic (fmt=fmt@entry=0xc11b224c "trap") at /usr/src/sys/kern/subr_prf.c:209
  #5  0xc013026e in trap (frame=0xdbaf2df4) at /usr/src/sys/arch/i386/i386/trap.c:357
  #6  0xc0125333 in alltraps ()
  #7  0xdbaf2df4 in ?? ()
  #8  0xc0db7b09 in arpintr (arg=<optimized out>) at /usr/src/sys/netinet/if_arp.c:736
  #9  0xc0c70b5e in softint_execute (s=4, l=0xc3e26300) at /usr/src/sys/kern/kern_softint.c:599
  #10 softint_dispatch (pinned=0xc3e26040, s=4) at /usr/src/sys/kern/kern_softint.c:848
  #11 0xc0102ab8 in Xsoftintr ()
  #12 0xc3e26040 in ?? ()
  Backtrace stopped: previous frame inner to this frame (corrupt stack?)
  (gdb) frame 8
  #8  0xc0db7b09 in arpintr (arg=<optimized out>) at /usr/src/sys/netinet/if_arp.c:736
  736				in_arpinput(m);
  (gdb) print m
  $1 = (struct mbuf *) 0x4
  (gdb) up
  #9  0xc0c70b5e in softint_execute (s=4, l=0xc3e26300) at /usr/src/sys/kern/kern_softin

  599				(*sh->sh_func)(sh->sh_arg);
  (gdb) print *sh
  $2 = {sh_q = {sqe_next = 0x0}, sh_func = 0xc0db79e4 <arpintr>, sh_arg = 0x0, sh_isr = 0xdb666160, sh_flags = 771, sh_ipi_id = 5}
  (gdb) 

>How-To-Repeat:

Don't know, it has only happened once.

>Fix: