Um, there is a comment in spec_close() that says that s_ttyvp may have v_opencount==0 (if the tty was revoked). But then vop_stdclose() is called unconditionally at the end of spec_close(). It seems to me that it should be called if and only if v_opencount > 0.
Thomas, Could you check in the crash dump the value of p->p_session->s_ttyvp in the innermost call to spec_close() please? Cheers, Nicolas
