That looks plausibly correct. Two thoughts: Have you run with LOCKDEBUG? We have found that netbsd-6 can run with LOCKDEBUG and stay up, only about a 2x speed penalty. you are making changes to the upstream ipfilter. that's just how it is. But I wonder if the lock should be in the ifdef on recent netbsd; I do not recall when the locking rules changed.
Attachment:
pgp4xQ7Mi1RzC.pgp
Description: PGP signature