Greetings: I will not have time for a proper bug report until this evening when I get home, but I thought I would throw this out there for now.
This issue is reproducible, and it occurred in the previous snapshot as well. Briefly, here is how it happens: I have net.inet.ip.forwarding=1, and two interfaces: re0 is on my internal LAN which is routed to the internet through another box running 4.0-stable. vr0 is connected to an ibook, also running 4.0-stable, through a switch. The box that panics (vtest) is pretty much idle except for forwarding packets. pf is disabled. To produce the panic, I just generate a lot of traffic from the ibook (a cvs update of /usr/src is generally sufficient). dmesg and ddb output follow. vtest is still sitting at the ddb> prompt in case someone can suggest additional information I might gather. >> OpenBSD/i386 BOOT 2.13 boot> booting hd0a:/bsd: entry point at 0x200120 [ using 550188 bytes of bsd ELF symbol table ] Copyright (c) 1982, 1986, 1989, 1991, 1993 The Regents of the University of California. All rights reserved. Copyright (c) 1995-2007 OpenBSD. All rights reserved. http://www.OpenBSD.org OpenBSD 4.1-beta (GENERIC) #1367: Tue Feb 13 14:05:15 MST 2007 [EMAIL PROTECTED]:/usr/src/sys/arch/i386/compile/GENERIC cpu0: VIA Esther processor 1200MHz ("CentaurHauls" 686-class) 1.21 GHz cpu0: FPU,V86,DE,PSE,TSC,MSR,PAE,MCE,APIC,SEP,MTRR,PGE,CMOV,PAT,CFLUSH,ACPI,MMX,FXSR,SSE,SSE2,TM,SBF,SSE3,EST,TM2 cpu0: RNG AES AES-CTR SHA1 SHA256 RSA real mem = 1005023232 (981468K) avail mem = 908505088 (887212K) using 4256 buffers containing 50376704 bytes (49196K) of memory mainbus0 (root) bios0 at mainbus0: AT/286+ BIOS, date 07/18/06, BIOS32 rev. 0 @ 0xfb570, SMBIOS rev. 2.3 @ 0xf0000 (34 entries) apm0 at bios0: Power Management spec V1.2 apm0: AC on, battery charge unknown apm0: flags 70102 dobusy 1 doidle 1 pcibios0 at bios0: rev 2.1 @ 0xf0000/0xdc84 pcibios0: PCI IRQ Routing Table rev 1.0 @ 0xfdbb0/208 (11 entries) pcibios0: bad IRQ table checksum pcibios0: PCI BIOS has 11 Interrupt Routing table entries pcibios0: PCI Exclusive IRQs: 5 10 11 pcibios0: PCI Interrupt Router at 000:17:0 ("VIA VT8237 ISA" rev 0x00) pcibios0: PCI bus #1 is the last bus bios0: ROM list: 0xc0000/0xfc00 acpi at mainbus0 not configured cpu0 at mainbus0 cpu0: Enhanced SpeedStep 1200 MHz (860 mV): speeds: 1200, 1000, 800, 600, 400 MHz pci0 at mainbus0 bus 0: configuration mode 1 (no bios) pchb0 at pci0 dev 0 function 0 "VIA CN700 Host" rev 0x00 pchb1 at pci0 dev 0 function 1 "VIA CN700 Host" rev 0x00 pchb2 at pci0 dev 0 function 2 "VIA CN700 Host" rev 0x00 pchb3 at pci0 dev 0 function 3 "VIA PT890 Host" rev 0x00 pchb4 at pci0 dev 0 function 4 "VIA CN700 Host" rev 0x00 pchb5 at pci0 dev 0 function 7 "VIA CN700 Host" rev 0x00 ppb0 at pci0 dev 1 function 0 "VIA VT8377 AGP" rev 0x00 pci1 at ppb0 bus 1 vga1 at pci1 dev 0 function 0 "VIA S3 Unichrome PRO IGP" rev 0x01: aperture at 0xf4000000, size 0x10000000 wsdisplay0 at vga1 mux 1: console (80x25, vt100 emulation) wsdisplay0: screen 1-5 added (80x25, vt100 emulation) "VIA VT6306 FireWire" rev 0x80 at pci0 dev 10 function 0 not configured re0 at pci0 dev 11 function 0 "Realtek 8169" rev 0x10, RTL8169/8110SC (0x1800): irq 5, address 00:30:18:a8:10:78 rgephy0 at re0 phy 7: RTL8169S/8110S PHY, rev. 2 pciide0 at pci0 dev 15 function 0 "VIA VT6420 SATA" rev 0x80: DMA pciide0: using irq 11 for native-PCI interrupt pciide1 at pci0 dev 15 function 1 "VIA VT82C571 IDE" rev 0x06: ATA133, channel 0 configured to compatibility, channel 1 configured to compatibility wd0 at pciide1 channel 0 drive 0: <Maxtor 90680U2> wd0: 16-sector PIO, LBA, 6490MB, 13293504 sectors wd0(pciide1:0:0): using PIO mode 4, Ultra-DMA mode 4 pciide1: channel 1 disabled (no drives) uhci0 at pci0 dev 16 function 0 "VIA VT83C572 USB" rev 0x81: irq 10 usb0 at uhci0: USB revision 1.0 uhub0 at usb0 uhub0: VIA UHCI root hub, rev 1.00/1.00, addr 1 uhub0: 2 ports with 2 removable, self powered uhci1 at pci0 dev 16 function 1 "VIA VT83C572 USB" rev 0x81: irq 10 usb1 at uhci1: USB revision 1.0 uhub1 at usb1 uhub1: VIA UHCI root hub, rev 1.00/1.00, addr 1 uhub1: 2 ports with 2 removable, self powered uhci2 at pci0 dev 16 function 2 "VIA VT83C572 USB" rev 0x81: irq 11 usb2 at uhci2: USB revision 1.0 uhub2 at usb2 uhub2: VIA UHCI root hub, rev 1.00/1.00, addr 1 uhub2: 2 ports with 2 removable, self powered uhci3 at pci0 dev 16 function 3 "VIA VT83C572 USB" rev 0x81: irq 11 usb3 at uhci3: USB revision 1.0 uhub3 at usb3 uhub3: VIA UHCI root hub, rev 1.00/1.00, addr 1 uhub3: 2 ports with 2 removable, self powered ehci0 at pci0 dev 16 function 4 "VIA VT6202 USB" rev 0x86: irq 11 ehci0: timed out waiting for BIOS usb4 at ehci0: USB revision 2.0 uhub4 at usb4 uhub4: VIA EHCI root hub, rev 2.00/1.00, addr 1 uhub4: 8 ports with 8 removable, self powered viapm0 at pci0 dev 17 function 0 "VIA VT8237 ISA" rev 0x00 iic0 at viapm0 auvia0 at pci0 dev 17 function 5 "VIA VT8233 AC97" rev 0x60: irq 11 ac97: codec id 0x56494170 (VIA Technologies <70>) ac97: codec features headphone, 18 bit DAC, 18 bit ADC, KS Waves 3D audio0 at auvia0 vr0 at pci0 dev 18 function 0 "VIA RhineII-2" rev 0x78: irq 10, address 00:30:18:a6:91:2e ukphy0 at vr0 phy 1: Generic IEEE 802.3u media interface, rev. 10: OUI 0x004063, model 0x0032 isa0 at mainbus0 isadma0 at isa0 pckbc0 at isa0 port 0x60/5 pckbd0 at pckbc0 (kbd slot) pckbc0: using irq 1 for kbd slot wskbd0 at pckbd0: console keyboard, using wsdisplay0 pcppi0 at isa0 port 0x61 midi0 at pcppi0: <PC speaker> spkr0 at pcppi0 lpt0 at isa0 port 0x378/4 irq 7 npx0 at isa0 port 0xf0/16: reported by CPUID; using exception 16 pccom0 at isa0 port 0x3f8/8 irq 4: ns16550a, 16 byte fifo pccom0: console pccom1 at isa0 port 0x2f8/8 irq 3: ns16550a, 16 byte fifo fdc0 at isa0 port 0x3f0/6 irq 6 drq 2 biomask ff45 netmask ff65 ttymask ffe7 pctr: user-level cycle counter enabled dkcsum: wd0 matches BIOS drive 0x80 root on wd0a rootdev=0x0 rrootdev=0x300 rawdev=0x302 Automatic boot in progress: starting file system checks. /dev/rwd0a: file system is clean; not checking /dev/rwd0f: file system is clean; not checking /dev/rwd0e: file system is clean; not checking /dev/rwd0d: file system is clean; not checking setting tty flags net.inet.ip.forwarding: 0 -> 1 net.inet6.ip6.forwarding: 0 -> 1 starting network starting system logger starting initial daemons: ntpd. savecore: no core dump checking quotas: done. building ps databases: kvm dev. clearing /tmp starting pre-securelevel daemons:. setting kernel security level: kern.securelevel: 0 -> 1 creating runtime link editor directory cache. preserving editor files starting network daemons: dhcpd sendmail inetd sshd. starting local daemons:. standard daemons: cron. Tue Feb 13 20:43:00 MST 2007 OpenBSD/i386 (-----.----.-----.--.--) (tty00) login: panic: pool_get(mclpl): free list modified: magic=c3cd6f0b; page 0xd7c1f000; item addr 0xd7c1f800 Stopped at Debugger+0x4: leave RUN AT LEAST 'trace' AND 'ps' AND INCLUDE OUTPUT WHEN REPORTING THIS PANIC! DO NOT EVEN BOTHER REPORTING THIS WITHOUT INCLUDING THAT INFORMATION! ddb> trace Debugger(d077d6c0,d7c1e000,d7d7bf00,d7c1f800,d077d6c0) at Debugger+0x4 panic(d067e300,d06801c9,c3cd6f0b,d7c1f000,d7c1f800) at panic+0x63 pool_get(d077d6c0,0,d7d08000,401,1) at pool_get+0x2e9 vr_encap(d19c8000,d19c8a6c,d7d11c00,d7d7c200) at vr_encap+0xa5 vr_start(d19c8034,d7d0e006,6,745a3b4) at vr_start+0x90 ether_output(d19c8034,d7d7c200,d077eaac,d7c55004,d08b3cf4) at ether_output+0x36 4 ip_output(d7d7c200,0,d077eaa8,1,0,0,44,1) at ip_output+0x98b ip_forward(d7d7c200,0,0,50,d7d7c200) at ip_forward+0x1a3 ipv4_input(d7d7c200,d1918cc0,3,d08b3e7c,30) at ipv4_input+0x258 ipintr(58,10,10,10,d08b3e7c) at ipintr+0x70 Bad frame pointer: 0xd08b3e24 ddb> ps PID PPID PGRP UID S FLAGS WAIT COMMAND 10709 4936 10709 1000 3 0x4082 poll top 4936 13696 4936 1000 3 0x4082 pause ksh 13696 697 697 1000 3 0x180 select sshd 697 2963 697 0 3 0x4180 netio sshd 22448 1 22448 0 3 0x4082 ttyin getty 3650 1 3650 0 3 0x4082 ttyin getty 31658 1 31658 0 3 0x4082 ttyin getty 23499 1 23499 0 3 0x4082 ttyin getty 5154 1 5154 0 3 0x4082 ttyin getty 15017 1 15017 0 3 0x4082 ttyin getty 26300 1 26300 0 3 0x80 select cron 20473 1 20473 0 3 0x40180 select sendmail 2963 1 2963 0 3 0x80 select sshd 24221 1 24221 0 3 0x180 select inetd 11454 1 11454 77 3 0x180 poll dhcpd 27894 30617 30617 83 3 0x180 poll ntpd 30617 1 30617 0 3 0x80 poll ntpd 10735 12052 12052 73 3 0x180 poll syslogd 12052 1 12052 0 3 0x88 netio syslogd 17 0 0 0 3 0x100200 crypto_wa crypto 16 0 0 0 3 0x100200 aiodoned aiodoned 15 0 0 0 3 0x100200 syncer update 14 0 0 0 3 0x100200 cleaner cleaner 13 0 0 0 3 0x100200 reaper reaper 12 0 0 0 3 0x100200 pgdaemon pagedaemon 11 0 0 0 3 0x100200 pftm pfpurge 10 0 0 0 3 0x100200 wait wskbd_hotkey 9 0 0 0 3 0x100200 usbevt usb4 8 0 0 0 3 0x100200 usbevt usb3 7 0 0 0 3 0x100200 usbevt usb2 6 0 0 0 3 0x100200 usbevt usb1 5 0 0 0 3 0x100200 usbtsk usbtask 4 0 0 0 3 0x100200 usbevt usb0 3 0 0 0 3 0x100200 apmev apm0 2 0 0 0 3 0x100200 kmalloc kmthread 1 0 1 0 3 0x4080 wait init 0 -1 0 0 3 0x80200 scheduler swapper ddb>