>Number:         23335
>Category:       kern
>Synopsis:       IPV6 and wi0 card removal trashes memory
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sat Nov 01 17:20:00 UTC 2003
>Closed-Date:
>Last-Modified:
>Originator:     Christos Zoulas
>Release:        NetBSD 1.6ZE
>Organization:
	Entropy Unlimited
>Environment:
NetBSD shiny.astron.com 1.6ZE NetBSD 1.6ZE (SHINY) #194: Sat Nov  1 02:03:49 EST 2003  christos@shiny.astron.com:/usr/src/sys/arch/i386/compile/SHINY i386
Architecture: i386
Machine: i386
>Description:
	On my laptop, with IPV6 configured, removing wi0 produces data
	modified on the freelist warnings.
wi0 detached
Data modified on freelist: word 8 of object 0xc0c0aec0 size 64 previous type bar (0xdeadbeed != 0xdeadbeef)
malloc log entry 78399:
        addr = 0xc0c0aec0
        size = 0
        type = in_multi
        action = free
        file = ../../../../netinet6/in6.c
        line = 1938
Data modified on freelist: word 8 of object 0xc0c0af00 size 64 previous type bar (0xdeadbeed != 0xdeadbeef)
malloc log entry 78400:
        addr = 0xc0c0af00
        size = 0
        type = in_multi
        action = free
        file = ../../../../netinet6/in6.c
        line = 1938
Data modified on freelist: word 8 of object 0xc0c0af80 size 64 previous type bar (0xdeadbeed != 0xdeadbeef)
malloc log entry 78401:
        addr = 0xc0c0af80
        size = 0
        type = in_multi
        action = free
        file = ../../../../netinet6/in6.c
        line = 1938

>How-To-Repeat:
	Compile a kernel with MALLOCLOG, configure ipv6 on a pcmcia interface,
	remove the card.

>Fix:
	unknown
>Release-Note:
>Audit-Trail:
>Unformatted: