About two weeks ago I send-pr'd the following trivially repeatable =20
crash. I do realise that  although this is an important problem to me =20=

it may not raise to the top of everyone's heap, especially with 2.0 in =20=

the final stages of release pain.

However, I'd still really, really appreciate if someone could take a =20
look at this. This is a really painful problem for me.

Regards,

Johan Ihr=E9n
-----
         Here are stack traces from dumps in several (similar =20
situations). Note
         that the fault is always the same and the immediately preceding
         call is always in6ifa_ifpforlinklocal().

         I noticed this problem a few days ago in 2.0G, upgraded to =20
2.99.10 in
         hope of it being fixed, but that seems not to be the case.

         #1: This is a /etc/rc.d/network restart with vlan1, vlan15 and =20=

vlan16
             configured:

uvm_fault(0xc707fee0, 0x5f666000, 0, 1) -> 0xe
kernel: page fault trap, code=3D0
Stopped in pid 175.1 (ifconfig) at      =20
netbsd:in6ifa_ifpforlinklocal+0x1a:     c
mpl     $0,0(%eax)
db> trace
in6ifa_ifpforlinklocal(c10b2400,7,40,c01982e8,c10e9214) at =20
netbsd:in6ifa_ifpforlinklocal+0x1a
nd6_prefix_onlink(c108d180,7,80,c10eae00,c0ed381c) at =20
netbsd:nd6_prefix_onlink+0xe9
pfxlist_onlink_check(9434,1227,7,0,8000093) at =20
netbsd:=20
pfxlist_onlink_check+0x255prelist_remove(c10eae00,282,c7b5ab1c,c044ec6d,=20=

181c) at netbsd:prelist_remove+0x11e
nd6_purge(c10b2000,c0952480,c7b5ab6c,c017ea9f,7) at =20
netbsd:nd6_purge+0xbc
in6_ifdetach(c10b2000,0,0,c10fc2f0,0) at netbsd:in6_ifdetach+0x20
in6_purgeif(c10b2000,c10b2000,c7b5abfc,c04e2e72,10) at =20
netbsd:in6_purgeif+0x50
udp6_usrreq(c7b5ac44,16,0,0,c10b2000) at netbsd:udp6_usrreq+0x63
if_detach(c10b2000,c10b2000,0,0,0) at netbsd:if_detach+0x13f
vlan_clone_destroy(c10b2000,0,20,0,5) at netbsd:vlan_clone_destroy+0x7d
if_clone_destroy(c7b5ae74,c7941fe6,0,3,c0206976) at =20
netbsd:=20
if_clone_destroy+0x68ifioctl(c119079c,80206979,c7b5ae74,c7941e60,800cefb=20=

) at netbsd:ifioctl+0xde
soo_ioctl(c70d2b98,80206979,c7b5ae74,c7941e60,0) at =20
netbsd:soo_ioctl+0x20b
sys_ioctl(c7082ef4,c7b5af64,c7b5af5c,c7b5af60,4) at =20
netbsd:sys_ioctl+0x30a
syscall_plain() at netbsd:syscall_plain+0x119
--- syscall (number 54) ---
0x4810a10f:
db>


         #2: This is /etc/rc.d.network restart after *first* doing
             "ifconfig vlanN destroy" (for all the created vlanN =20
interfaces):


/etc/rc.d/network stop
Stopping network.
Deleting aliases.
Downing network interfaces: fxp0 bce0.
+ /etc/rc.d/network start
Starting network.
Hostname: server.zeta.dnslab
IPv6 mode: router
Configuring network interfaces: fxp0 bce0 vlan1uvm_fault(0xc707f700, =20
0x5f666000, 0, 1) -> 0xe
kernel: page fault trap, code=3D0
Stopped in pid 230.1 (ifconfig) at      =20
netbsd:in6ifa_ifpforlinklocal+0x1a:     c
mpl     $0,0(%eax)
db> trace
in6ifa_ifpforlinklocal(c10b2000,7,40,0,1c) at =20
netbsd:=20
in6ifa_ifpforlinklocal+0x1and6_prefix_onlink(c10eac80,4,c1191b00,3,c7aef=20=

ea0) at netbsd:nd6_prefix_onlink+0xe9
pfxlist_onlink_check(0,2fe000,1,8078691a,8078691a) at =20
netbsd:pfxlist_onlink_check+0x255
in6_control(c10d15e8,8078691a,c7aefe74,c1092000,c79411a0) at =20
netbsd:in6_control+0xbd3
udp6_usrreq(c10d15e8,b,8078691a,c7aefe74,c1092000) at =20
netbsd:udp6_usrreq+0x34
ifioctl(c10d15e8,8078691a,c7aefe74,c79411a0,0) at netbsd:ifioctl+0x9cf
soo_ioctl(c70d2380,8078691a,c7aefe74,c79411a0,0) at =20
netbsd:soo_ioctl+0x20b
sys_ioctl(c7082ad4,c7aeff64,c7aeff5c,c7aeff60,c053bad7) at =20
netbsd:sys_ioctl+0x30a
syscall_plain() at netbsd:syscall_plain+0x119
--- syscall (number 54) ---
0x4810a10f:
db>


         #3: This is a plain "ifconfig vlan16 destroy" that didn't work =20=

out:


server:/etc#ifconfig vlan16
vlan16: flags=3D8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
         capabilities=3D6<TCP4CSUM,UDP4CSUM>
         enabled=3D0
         vlan: 16 parent: fxp0
         address: 00:02:b3:89:ee:28
         inet6 fe80::202:b3ff:fe89:ee28%vlan16 prefixlen 64 scopeid 0xc
server:/etc#ifconfig vlan16 destroy
uvm_fault(0xc707fd20, 0x5f666000, 0, 1) -> 0xe
kernel: page fault trap, code=3D0
Stopped in pid 143.1 (ifconfig) at      =20
netbsd:in6ifa_ifpforlinklocal+0x1a:
c
mpl     $0,0(%eax)
db> trace
in6ifa_ifpforlinklocal(c10b2400,7,40,c01982e8,c10e952c) at =20
netbsd:in6ifa_ifpfor
inklocal+0x1a
nd6_prefix_onlink(c108d180,7,80,c10ea800,c0ed381c) at =20
netbsd:nd6_prefix_onlink+
xe9
pfxlist_onlink_check(97ab,f184,7,0,181c) at =20
netbsd:pfxlist_onlink_check+0x255
prelist_remove(c10ea800,282,c7b44b1c,c044ec6d,181c) at =20
netbsd:prelist_remove+0x
1e
nd6_purge(c1092000,c0952480,c7b44b6c,c017ea9f,7) at =20
netbsd:nd6_purge+0xbc
in6_ifdetach(c1092000,0,0,0,0) at netbsd:in6_ifdetach+0x20
in6_purgeif(c1092000,c1092000,c7b44bfc,c04e2e72,10) at =20
netbsd:in6_purgeif+0x50
udp6_usrreq(c7b44c44,16,0,0,c1092000) at netbsd:udp6_usrreq+0x63
if_detach(c1092000,c1092000,0,0,0) at netbsd:if_detach+0x13f
vlan_clone_destroy(c1092000,0,20,0,5) at netbsd:vlan_clone_destroy+0x7d
if_clone_destroy(c7b44e74,c7941e4e,0,3,c0206976) at =20
netbsd:if_clone_destroy+0x6


ifioctl(c10d11b0,80206979,c7b44e74,c7941cc8,800cefb) at =20
netbsd:ifioctl+0xde
soo_ioctl(c70d2038,80206979,c7b44e74,c7941cc8,0) at =20
netbsd:soo_ioctl+0x20b
sys_ioctl(c7082e70,c7b44f64,c7b44f5c,c053e5fe,292) at =20
netbsd:sys_ioctl+0x30a
syscall_plain() at netbsd:syscall_plain+0x119
--- syscall (number 54) ---
0x4810a10f:
db>


         etc. I can provide more examples. It is not difficult to =20
trigger this.