Changing a VLAN Tag: panic on ifconfig vlanNN destroy

[Edgar Fuß <ef%math.uni-bonn.de@localhost>]

What's the supposed way to change the tag of a vlan(4) pseudo-device?

Issuing
        ifconfig vlanNN vlan XXX
gives
        SIOCSETVLAN: Device busy
while
        ifconfig vlanNN destroy
resulted on a panic on two hosts (see below)

Regarding the panics, I first tried the destroy on a 4.0.1/amd64 host with 
an uptime of 1305 days, and it paniced. I rebooted and couldn't reproduce 
the panic.
Then I tried a 6.1/amd64 server, and it worked.
Next, anonther 4.0.1/amd64 (same hardware and setup as the first, uptime 
175 days) and it worked.
After that, another "twin" machine, uptime 1643 days, and it paniced like 
the first one.

uvm_fault(0xffffffff806a2499, 0xffff80000a1a2000, 1) -> e
kernel: page fault trap, code=0
Stopped in pid 27765.1 (ifconfig) at    netbsd:rn_walktree+0x37:        movq    
0x28(%rdx),%rbx

ds      0xe140
es      0xe400
fs      0xe400
gs      0x5a88
rdi     0xffff80000a1a1b80
rsi     0xffff80004e5e48f0
rbp     0
rbx     0xffff80000a1a1b80
rdx     0xffff80000a1aff00
rcx     0x286
rax     0xffff80000a1a1b80
r8      0x8
r9      0
r10     0xffff80004e5e496c
r11     0xffff800008fb3080
r12     0xffff70000a2de400
r13     0xffffffff8033e140      if_rt_walktree
r14     0xffff80000a2de400
r15     0xffff80004e5e4b30
rip     0xffffffff8034db87      rn_walktree+0x37
cs      0x8
rflags  0x10246
rsp     0xffff80004e5e4af0
ss      0x10

uvm_fault(0xffffffff806a2400, 0xffff80000a516000, 1) -> e
kernel: page fault trap, code=0
Stopped in pid 25054.1 (ifconfig) at    netbsd:rn_walktree+0x37:        movq    
0x28(%rdx),%rbx

ds      0xe140
es      0x2400
fs      0x2400
gs      0x4118
rdi     0xffff80000a515348
rsi     0xffff80005031f8f0
rbp     0
rbx     0xffff80000a515348
rdx     0xffff80000a515ff0
rcx     0x286
rax     0xffff80000a515348
r8      0x8
r9      0x1
r10     0xffff80005031f96c
r11     0xffff8000090fee80
r12     0xffff80000fda2400
r13     0xffffffff8033e140      if_rt_walktree
r14     0xffff80000fda2400
r15     0xffff80005031fb30
rip     0xffffffff8034db87      rn_walktree+0x37
cs      0x8
rflags  0x10246
rsp     0xffff80005031faf0
ss      0x10