> > Can you try with a LOCKDEBUG + DEBUG/DIAGNOSTIC kernel? > > The kernel has all three options.
Hm, if you have DEBUG enabled, kern_free() might fill free'ed area with WEIRD_ADDR. enami. Index: sys/netinet/ip_reass.c =================================================================== RCS file: /cvsroot/src/sys/netinet/ip_reass.c,v retrieving revision 1.4 diff -u -r1.4 ip_reass.c --- sys/netinet/ip_reass.c 3 Oct 2010 19:44:47 -0000 1.4 +++ sys/netinet/ip_reass.c 6 Oct 2010 01:52:14 -0000 @@ -390,7 +390,6 @@ pool_cache_put(ipfren_cache, q); m_cat(m, t); } - free(fp, M_FTABLE); /* * Create header for new packet by modifying header of first @@ -400,6 +399,7 @@ ip->ip_len = htons((ip->ip_hl << 2) + next); ip->ip_src = fp->ipq_src; ip->ip_dst = fp->ipq_dst; + free(fp, M_FTABLE); m->m_len += (ip->ip_hl << 2); m->m_data -= (ip->ip_hl << 2);