The following reply was made to PR kern/35273; it has been noted by GNATS.

From: "Denis Lagno" <dlagno@rambler.ru>
To: gnats-bugs@netbsd.org
Cc: kern-bug-people@netbsd.org, gnats-admin@netbsd.org,
	netbsd-bugs@netbsd.org
Subject: Re: kern/35273: ex(4) is broken and may cause kernel crash
Date: Fri, 29 Dec 2006 02:18:39 +0300

 > >Synopsis:       ex(4) is broken and may cause kernel crash
 > >Environment:
 > NetBSD flam.gado 4.99.6 NetBSD 4.99.6 (FLAM) #0: Mon Dec 18 05:11:17 MSK 2006  dina@flam.gado:/volatile/worksrc/netbsd-curre
 > nt/obj/sys/arch/i386/compile/FLAM i386
 > Architecture: i386
 > Machine: i386
 > SMP machine
 > >Description:
 > I have this network card:
 > ex0 at pci0 dev 11 function 0: 3Com 3c905B-TX 10/100 Ethernet (rev. 0x24)
 > ex0: interrupting at ioapic0 pin 17 (irq 10)
 > 
 > # ifconfig ex0
 > ex0: flags=8863<UP,BROADCAST,NOTRAILERS,RUNNING,SIMPLEX,MULTICAST> mtu 1500
 >         capabilities=3f00<IP4CSUM_Rx,IP4CSUM_Tx,TCP4CSUM_Rx,TCP4CSUM_Tx,UDP4CSUM_Rx,UDP4CSUM_Tx>
 >         enabled=3f00<IP4CSUM_Rx,IP4CSUM_Tx,TCP4CSUM_Rx,TCP4CSUM_Tx,UDP4CSUM_Rx,UDP4CSUM_Tx>
 >         address: 00:10:4b:67:87:27
 >         media: Ethernet autoselect (100baseTX full-duplex)
 >         status: active
 >         inet 10.239.17.213 netmask 0xffff0000 broadcast 10.239.255.255
 >         inet6 fe80::210:4bff:fe67:8727%ex0 prefixlen 64 scopeid 0x1
 > 
 > it worked fine with -current 3 months old
 > 
 > Today either kernel crashes, or just network malfunctions
 > (even with capabilities turned off and untouched)
 > 
 > This is example of crash (they are always in rtflushall):
 > 
 > uvm_fault(0xccc7eee8, 0, 1) -> oxe
 > kernel: supervisor trap page fault, code=0
 > Stopped in pid xxx.1 (ifconfig) at netbsd:in_rtflushall+0x4e: movl 0x38(%edx),%eax
 > 
 > 
 > Second ex card seems to work fine:
 > 
 > ex1 at pci0 dev 12 function 0: 3Com 3c905-TX 10/100 Ethernet (rev. 0x0)
 > ex1: interrupting at ioapic0 pin 16 (irq 11)
 > 
 > # ifconfig ex1
 > ex1: flags=8a63<UP,BROADCAST,NOTRAILERS,RUNNING,ALLMULTI,SIMPLEX,MULTICAST> mtu 1500
 >         address: 00:60:98:ef:e3:5d
 >         media: Ethernet autoselect (100baseTX full-duplex)
 >         status: active
 >         inet 192.168.0.11 netmask 0xffffff00 broadcast 192.168.0.255
 >         inet6 fe80::260:98ff:feef:e35d%ex1 prefixlen 64 scopeid 0x2
 > 
 > However it is just statically configured, and I don't know whether it will work in more complex configurations.
 > 
 > >How-To-Repeat:
 > play with 3Com 3c905B-TX
 > >Fix:
 > N/A
 
 it seems that crash is not related to ex(4)
 
 following is backtrace on today kernel:
 
 uvm_fault(0xccb69464, 0, 1) -> 0xe
 kernel: supervisor trap page fault, code=0
 Stopped in pid xxxx.1 (ifconfig) at netbsd:in_rtflushall+0x4e: movl  0x38(%edx),%eax
 
 bt:
 in_rtflushall(2,c1ef6ee4,cccad928,c1ef6ee4,cccad7d0)
 rtrequest1(1,cccad928,cccad95c,1,ccbd1820)
 rtinit(c2532100,1,1,246,0)
 in_ifinit(c1d0b040,c2532100,cccadba8,0,8040691a)
 in_control(c1eeb01c,8040691a,cccadb98,c1d0b040,ccbd1820)
 compat_ifioctl(c1eeb01c,8040691,cccadb98,ccbd1820,80206910)
 ifioctl(c1eeb01c,8040691a,cccadb98,ccbd1820,c1a5a488)
 sys_ioctl(ccbd1820,cccadc48,cccadc68,c0561458,246)
 syscall_plain()
 
 .