>> >I think this patch fix the problem.
>> 	the patch #if 0's the whole policy expiration code, and does not
>> 	seem to be right...
>I'm not sure why policy expiration code should be
>in timerhandler.
>freeing sp when refcount drops to zero is enough, isn't it?
>actually, timerhandler seems to call freesp multiply
>for sp that is marked as DEAD. it's a cause of panics.

	now i see the problem (reference from sptree is not properly reference-
	counted, that's the problem).  thanks for pointing it out.

itojun