mbuf leak on NetBSD-5 AP when Windows laptop connects

[Roy Marples <roy%marples.name@localhost>]

Hi List!

I've been running NetBSD-5 on my Access Point for some time, with great 
success.
However, when a Windows based laptop connects to the network, the AP 
runs out of mbufs in about 45 minutes. This is 100% reproducable with 
minimal traffic from laptop -> AP. When the laptop is turned off, the AP 
is fine and has no trouble talking to my other boxes (1 laptop, 2 
desktops, 1 wii).

I have attached an mbuf watchdog script that runs as a cron job every 5 
minutes to check that total claimed mbufs do not exceed 1000 - if it 
does, it restarts the AP interface. Currently, it is emailing me every 
15 minutes.
Here is some sample output

1059 mbufs in use:
        1033 mbufs allocated to data
        24 mbufs allocated to packet headers
        2 mbufs allocated to socket names and addresses
4 calls to protocol drain routines
mbufs exceed 1000 - restarting ath0


The AP tracks the netbsd-5 branch and is an amd64 with an ath(4) 
wireless network card.
This behaviour was present both before and after the pullup was made to 
bring the new ath HAL into netbsd-5.
The AP also runs PF, PPPoE and ALTQ in the kernel.
options MBUFTRACE has been enabled and only "unknown data" is growing, 
which is of no help for working out where the problem lies.

The Windows laptop is a Lenovo T500 with an Intel Wifi Link 5100 AGN 
network card. It ran Vista32 an now Windows7 64, both with this problem.
#!/bin/sh

count=$(netstat -m | sed -e '1! d' -e 's/ .*//')
[ $count -lt 1000 ] && exit 0
netstat -m
echo "mbufs exceed 1000 - restarting ath0" >&2
ifconfig ath0 down
ifconfig ath0 up
exit 1