8.0-STABLE r200182: weird behaviour of a service in a jail

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
 
Hello,

I'm running FreeBSD 8.0-STABLE #0 r200182: Mon Dec  7 03:32:18 JST
2009 SMP (4 cores) with an uptime of ~44 days and starting about 1.5
weeks ago, I've noticed a weird behaviour with a jailed ircd (a hybrid
spin-off); it listens on a cloned address on lo0 and the connections
to it are redirected by pf. Everything was fine until once I noticed
that I (and other users, of course) cannot connect to the irc server -
the connection is established but then it just hangs indefinitely.
This problem has never manifested itself on 7.0-STABLE and 7.2-STABLE
on a single core system (ircd was also running inside a jail there).

It looks like this from the outside:

% telnet irc.server.here 6667
Trying (ip address here)...
Connected to irc.server.here.
Escape character is '^]'.

And that's it; normally I'd get "439 * :Please wait while we process
your connection."
Same with another - server link - port.

If I attempt to connect to the server's "real" listening IP from the
machine running ircd, however, I get

% telnet irc.server.here 6667
Trying (ip address here)...
Connected to irc.server.here.
Escape character is '^]'.
Connection closed by foreign host. (immediately, with no pause)

And on the server link port, it's still the same indefinite wait.

Amusingly enough, a simple REHASH - which resets ircd's listening
sockets - fixes the problem. The developers of the ircd state that
this behaviour is unexpected and there's nothing wrong with the source
code on their end (which I can believe). The ircd uses kqueue, if it
matters.

There are no abnormalities with sshd and sendmail in the same jail. No
problems ever arised in the 5 other jails running HTTP, SMTP and other
services; but that might be because ircd's load is much bigger in
terms of total number of established connections.

How should I debug this issue? For now, I've moved the jail to an
external IP address to see if the problem persists.

- -- 
Kamigishi Rei
KREI-RIPE
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (MingW32)
 
iQEcBAEBAgAGBQJLVzdTAAoJEPAgyqbDpP+efJUIAKB9MJgLiTnlQYkPnLXCqroG
fQqSilPODsztqkRc9MbbDLhUjk0PtBO/hFEIUrv2fUqOBbbf/H8TSRn7BdQuYUVU
6PsBrl+/e/jhP6y8wRsNudijlE1cQfxsjFJoNnoEHFKBY//6SedvMwMvxTy96CHf
WOkBnNJVUt/YB/Fq/DdZtNUlZpOWxxtGWHf/C75q5IdGfjk6R3uLABazUhIGHJoK
We/3gG2IVTf3zzKgCPwDaj3sLYQ1wkP4rOoAQjU+3pLynnR3xnQzv3XG2MtX3xEf
bFh2RrN/0ufoNgUDJeEVptJDveTYbpHIzCm9iVkETM7Tv0A/CSzIwy6QMbB/eIU=
=y1oH
-----END PGP SIGNATURE-----