panic: tcp_output REXMT

[Manuel Bouyer <bouyer%antioche.eu.org@localhost>]

Hi,
on a netbsd-3 amd64 server I've got this panic (several times now):
panic: tcp_output REXMT
panic() at netbsd:panic+0x1c8
tcp_segsize() at netbsd:tcp_segsize
tcp_timer_persist() at netbsd:tcp_timer_persist+0x73
softclock() at netbsd:softclock+0x2c9
softintr_dispatch() at netbsd:softintr_dispatch+0x99
DDB lost frame for netbsd:Xsoftclock+0x2d, trying 0xffffffff8069bcd0
Xsoftclock() at netbsd:Xsoftclock+0x2d

Does it ring a bell to someone ?

I can't make much sense of the stack trace. The panic is in tcp_setpersist()
and tcp_timer_persist() is calling tcp_setpersist(); so I guess the
tcp_segsize() here is wrong (I can't see from where it would be called in
tcp_timer_persist()).
Another path would be tcp_timer_persist()->tcp_output()->tcp_segsize()
but then I don't know where tcp_setpersist() is called from.
If called from tcp_output(), in both case we either call
TCP_TIMER_DISARM(tp, TCPT_REXMT) before or check
TCP_TIMER_ISARMED(tp, TCPT_REXMT) == 0. 
Another theory is that there's a code path arming TCPT_REXMT from
above splsoftnet().

I didn't see any evidence that this could be fixed in -current.

Any idea ?

-- 
Manuel Bouyer <bouyer%antioche.eu.org@localhost>
     NetBSD: 26 ans d'experience feront toujours la difference
--