panic: key_delsp: called with positive refcnt

Hi,

Got this panic when running the "net" program from Peter Holm's stress
test suite (http://www.holm.cc/stress/src/). Reproducable every time.

FreeBSD 6.0-CURRENT #0: Tue Aug 24 19:53:18 CEST 2004
Kernel config has IPSEC and ALTQ, none of which is configured (no pf
rules and no IPSec spd). Four way SMP box with debug.mpsafenet=1.

panic: key_delsp: called with positive refcnt
cpuid = 3
KDB: stack backtrace:
kdb_backtrace(c06ed976,3,c06e2fd5,f80f1a74,c072a710) at kdb_backtrace+0x2e
panic(c06e2fd5,c072fc7c,c263c600,0,c2884654) at panic+0x139
key_delsp(c263c600,c263c600,c2886654,c263c600,f80f1ac0) at key_delsp+0x32
key_freesp(c263c600,2,c2886654,f80f1ab4,0) at key_freesp+0x5e
ipsec4_hdrsiz(c2ae4e00,2,c2886654,2,c0520001) at ipsec4_hdrsiz+0xb8
ipsec_hdrsiz_tcp(c2888e00,c,c27855ec,c2785540,f80f1b4c) at
ipsec_hdrsiz_tcp+0xd8
tcp_output(c2888e00,c2783840,0,0,0) at tcp_output+0x9cf
tcp_usr_rcvd(c2884654,0,f80f1c7c,0,0) at tcp_usr_rcvd+0x14b
soreceive(c2884654,0,f80f1c7c,0,0) at soreceive+0xc6a
soo_read(c26c8770,f80f1c7c,c28d5c00,0,c2783840) at soo_read+0x93
dofileread(c2783840,c26c8770,4,bfbfe730,400) at dofileread+0xac
read(c2783840,f80f1d14,c,c2783840,f80f1d3c) at read+0x6b
syscall(c068002f,2f,2f,bfbfe730,4) at syscall+0x330
Xint0x80_syscall() at Xint0x80_syscall+0x1f
--- syscall (3, FreeBSD ELF32, read), eip = 0x280ca59f, esp =
0xbfbfe6fc, ebp = 0xbfbfeb68 ---
boot() called on cpu#3
Uptime: 53m31s
Dumping 1023 MB
  16 32 48 64 80 96 112 128 144 160 176 192 208 224 240 256 272 288 304
320 336 352 368 384 400 416 432 448 464 480 496 512 528 544 560 576 592
608 624 640 656 672 688 704 720 736 752 768 784 800 816 832 848[CTRL-C
to abort] [CTRL-C to abort]  864 880 896 912 928 944 960 976 992 1008
Dump complete
Shutting down ACPI
Automatic reboot in 15 seconds - press a key on the console to abort
Rebooting...
cpu_reset called on cpu#3
cpu_reset: Stopping other CPUs
cpu_reset: Restarting BSP
cpu_reset_proxy: Stopped CPU 3

-- 
Pawel