kern/60444: repeatable mutex "locking against myself" panic

["riz%tastylime.net@localhost via gnats" <gnats-admin%NetBSD.org@localhost>]

>Number:         60444
>Category:       kern
>Synopsis:       repeatable mutex "locking against myself" panic
>Confidential:   no
>Severity:       serious
>Priority:       high
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Mon Jul 13 01:05:00 +0000 2026
>Originator:     Jeff Rizzo
>Release:        11.0_RC5
>Organization:
>Environment:
NetBSD cherimoya.tastylime.net 11.0_RC5 NetBSD 11.0_RC5 (GENERIC) #0: Tue Jun 16 15:48:07 UTC 2026  mkrepro%mkrepro.NetBSD.org@localhost:/usr/src/sys/arch/amd64/compile/GENERIC amd64
>Description:
Configuring a second bridge(4) interface with brconfig yielded this panic twice in a row:

[ 456.7721093] Mutex error: mutex_vector_enter,551: locking against myself

[ 456.7821085] lock address : ffff824d6f282500
[ 456.7821085] current cpu  :                  1
[ 456.7921086] current lwp  : 0xffff824bc516e000
[ 456.7921086] owner field  : 0xffff824bc516e000 wait/spin:                0/0

[ 456.8021086] panic: lock error: Mutex: mutex_vector_enter,551: locking against myself: lock 0xffff824d6f282500 cpu 1 lwp 0xffff824bc516e000
[ 456.8121087] cpu1: Begin traceback...
[ 456.8221084] vpanic() at netbsd:vpanic+0x171
[ 456.8221084] panic() at netbsd:panic+0x3c
[ 456.8321084] lockdebug_abort() at netbsd:lockdebug_abort+0x114
[ 456.8421084] mutex_vector_enter() at netbsd:mutex_vector_enter+0x397
[ 456.8521084] bridge_input() at netbsd:bridge_input+0xaaf
[ 456.8521084] vlan_input() at netbsd:vlan_input+0x165
[ 456.8621084] ether_input() at netbsd:ether_input+0x2d2
[ 456.8721087] bridge_input() at netbsd:bridge_input+0xace
[ 456.8721087] lagg_input_ethernet() at netbsd:lagg_input_ethernet+0x20c
[ 456.8821084] if_percpuq_softint() at netbsd:if_percpuq_softint+0x9e
[ 456.8921085] softint_dispatch() at netbsd:softint_dispatch+0x95
[ 456.9021084] DDB lost frame for netbsd:Xsoftintr+0x4c, trying 0xffffd214ab5640f0
[ 456.9021084] Xsoftintr() at netbsd:Xsoftintr+0x4c
[ 456.9121086] --- interrupt ---
[ 456.9121086] 0:
[ 456.9121086] cpu1: End traceback...

[ 456.9221086] dumping to dev 168,8 (offset=8, size=18872056):
[ 456.9221086] dump failed: insufficient space (4194304 < 10795333)
>How-To-Repeat:
The current network configuration of this host, from rc.conf:

auto_ifconfig=NO
net_interfaces="lagg0 wm0 wm1 vlan600 bridge0"
ifconfig_bridge0="create ; up ; !brconfig bridge0 add lagg0"
ifconfig_wm0="up"
ifconfig_wm1="up"
ifconfig_lagg0="create ; laggproto lacp ; laggport wm0 ; laggport wm1 ; inet XXX.XXX.XXX.43/26 ; inet6 2001:xxxx:xxxx:2::43 prefixlen 64 ; up"
ifconfig_vlan600="create ; vlan 600 vlanif lagg0 ; up"

This runs fine; however, I wanted to add a second bridge(4) bridging the "vlan600" interface, for access by some virtual machines. Doing the following:

# ifconfig bridge600 create
# ifconfig bridge600 up
# brconfig bridge600 add vlan600

...repeatably causes the panic.  Yes, vlan600 is tagged on lagg0.  Yes, bridge0 bridges untagged frames from lagg0 .  I can't easily try changing the "untagged" frames to another vlan right now (they'd be on vlan2) to see if that gets rid of the panic.  This may well be a "don't do that" situation, but I figured I should let folks know, at least.
>Fix:
None given.  Maybe just "don't do that".