IPv6-related panic

[Timo Buhrmester <timo%math.uni-bonn.de@localhost>]

Our 8.2_STABLE (amd64) system paniced the other day in what appears to be an IPv6-related issue.

We had a tcpdump running at the time, which may or may not be related (I suspect it, though, as we had some years of uptime on that machine before)

Our own research led to sys/external/bsd/ipf/netinet/fil.c:942, fin->fin_m == NULL

Here's the DDB info:

| fatal page fault in supervisor mode
| trap type 6 code 0 rip 0xffffffff803e5099 cs 0x8 rflags 0x10206 cr2 0x20 ilevel 0x4 rsp 0xffff8000ad83e990
| curlwp 0xfffffe81ff624420 pid 0.3 lowest kstack 0xffff8000ad83c2c0
| kernel: page fault trap, code=0
| Stopped in pid 0.3 (system) at  netbsd:ipf_makefrip+0x12e0:     cmpl    20(%rax),%edx
| db{0}> bt
| ipf_makefrip() at netbsd:ipf_makefrip+0x12e0
| ipf_checkicmp6matchingstate() at netbsd:ipf_checkicmp6matchingstate+0xed
| ipf_state_lookup() at netbsd:ipf_state_lookup+0x749
| ipf_state_check() at netbsd:ipf_state_check+0x67
| ipf_check() at netbsd:ipf_check+0x94d
| pfil_run_hooks() at netbsd:pfil_run_hooks+0x11b
| ip6_input() at netbsd:ip6_input+0x1c2
| ip6intr() at netbsd:ip6intr+0x7b
| softint_dispatch() at netbsd:softint_dispatch+0x91
| DDB lost frame for netbsd:Xsoftintr+0x4f, trying 0xffff8000ad83f0f0
| Xsoftintr() at netbsd:Xsoftintr+0x4f
| --- interrupt ---
| 0:
| db{0}> show reg
| ds        1f80
| es        0
| fs        3528
| gs        0
| rdi       0
| rsi       fffffe81228f6868
| rbp       ffff8000ad83ea00
| rbx       3a
| rdx       bc
| rcx       94
| rax       0
| r8        ffffffff80a897a0 ipfmain
| r9        fffffe81228f6840
| r10       fffffe81fc917808
| r11       ffff8000ad83ed48
| r12       ffff8000ad83ed48
| r13       4400
| r14       ffff80000e708000
| r15       ffff8000ad83ea68
| rip       ffffffff80e35099 ipf_makefrip+0x12e0
| cs        8
| rflags    10206
| rsp       ffff8000ad83e990
| ss        10
| netbsd:ipf_makefrip+0x12e0:    cmpl    20(%rax),%edx
| db{0}>