ALPHA3 panic with ipfw+dummynet and gif/gre tunnels

Hello,

I can pretty reliably panic CURRENT by creating/destroying gif and gre
interfaces used for IPv6 tunnels. I'm uploading the dump, kernel.debug,
and kernel in a tarball here:

https://feld.me/freebsd/crash/r301929.tgz

It's still uploading so you might end up with an incomplete download if
you fetch it now. Here's the sha256 of it:

1e9fddad1da3bac2b11c51a18c7dad48eb9259acf844f35f5eb40630ca84de64 
r301929.tgz


Here's the backtrace:

(kgdb) bt
#0  doadump (textdump=0) at pcpu.h:221
#1  0xffffffff80391fab in db_dump (dummy=<value optimized out>,
dummy2=false, dummy3=0, dummy4=0x0) at /usr/src/sys/ddb/db_command.c:533
#2  0xffffffff80391da9 in db_command (cmd_table=<value optimized out>)
at /usr/src/sys/ddb/db_command.c:440
#3  0xffffffff80391b04 in db_command_loop () at
/usr/src/sys/ddb/db_command.c:493
#4  0xffffffff80394a3b in db_trap (type=<value optimized out>,
code=<value optimized out>) at /usr/src/sys/ddb/db_main.c:251
#5  0xffffffff80a88913 in kdb_trap (type=<value optimized out>,
code=<value optimized out>, tf=<value optimized out>) at
/usr/src/sys/kern/subr_kdb.c:654
#6  0xffffffff80eb8331 in trap_fatal (frame=0xfffffe0122831770, eva=26)
at /usr/src/sys/amd64/amd64/trap.c:836
#7  0xffffffff80eb857d in trap_pfault (frame=0xfffffe0122831770,
usermode=0) at /usr/src/sys/amd64/amd64/trap.c:691
#8  0xffffffff80eb7a64 in trap (frame=0xfffffe0122831770) at
/usr/src/sys/amd64/amd64/trap.c:442
#9  0xffffffff80e97f91 in calltrap () at
/usr/src/sys/amd64/amd64/exception.S:236
#10 0xffffffff80c57ebc in ip6_output (m0=<value optimized out>,
opt=<value optimized out>, ro=<value optimized out>, flags=<value
optimized out>, im6o=0x0, ifpp=0x0, inp=<value optimized out>)
    at /usr/src/sys/netinet6/ip6_output.c:1060
#11 0xffffffff82661fd2 in dummynet_send (m=<value optimized out>) at
/usr/src/sys/modules/dummynet/../../netpfil/ipfw/ip_dn_io.c:800
#12 0xffffffff82661890 in dummynet_task (context=<value optimized out>,
pending=<value optimized out>) at
/usr/src/sys/modules/dummynet/../../netpfil/ipfw/ip_dn_io.c:746
#13 0xffffffff80a9a1ac in taskqueue_run_locked (queue=<value optimized
out>) at /usr/src/sys/kern/subr_taskqueue.c:465
#14 0xffffffff80a9acf8 in taskqueue_thread_loop (arg=<value optimized
out>) at /usr/src/sys/kern/subr_taskqueue.c:719
#15 0xffffffff80a0b3e4 in fork_exit (callout=0xffffffff80a9ac70
<taskqueue_thread_loop>, arg=0xffffffff8266c8a8,
frame=0xfffffe0122831c00) at /usr/src/sys/kern/kern_fork.c:1038
#16 0xffffffff80e984ce in fork_trampoline () at
/usr/src/sys/amd64/amd64/exception.S:611
#17 0x0000000000000000 in ?? ()
Current language:  auto; currently minimal


-- 
  Mark Felder
  ports-secteam member
  feld_at_FreeBSD.org