kernel/1011: kernel crash, ipnat ftp proxy?

[timlee@netcom.com]

>Number:         1011
>Category:       kernel
>Synopsis:       kernel crash, ipnat ftp proxy?
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    bugs
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Wed Dec 15 17:20:02 MST 1999
>Last-Modified:
>Originator:     Timothy J. Lee
>Organization:
Timothy J. Lee (timlee@dsllogic.com)
>Release:        OpenBSD 2.5 with patches
>Environment:
	
	System      : OpenBSD 2.5
	Architecture: OpenBSD.i386
	Machine     : i386
>Description:
	Kernel crashes.  gdb output on saved core:

gdb /bsd.gdb
GNU gdb 4.16.1
Copyright 1996 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i386-unknown-openbsd2.5"...
(gdb) target kcore bsd.1.core
panic: m_copydata
#0  0x100 in ?? ()
(gdb) where
#0  0x100 in ?? ()
#1  0xf0121373 in panic (fmt=0xf012f818 "m_copydata")
    at ../../../../kern/subr_prf.c:202
#2  0xf012f856 in m_copydata (m=0xf0beff00, off=76, len=52, cp=0xf515dc2c "")
    at ../../../../kern/uipc_mbuf.c:457
#3  0xf017605b in ippr_ftp_pasvmsg (fin=0xf515dd14, ip=0xf4a6980e, 
    tcp=0xf4a69822, nat=0xf0c29b00) at ../../../../netinet/ip_ftp_pxy.c:281
#4  0xf01760ad in ippr_ftp_in (fin=0xf515dd14, ip=0xf4a6980e, aps=0xf0c20000, 
    nat=0xf0c29b00) at ../../../../netinet/ip_ftp_pxy.c:421
#5  0xf01762e3 in ap_check (ip=0xf4a6980e, fin=0xf515dd14, nat=0xf0c29b00)
    at ../../../../netinet/ip_proxy.c:225
#6  0xf0174533 in ip_natin (ip=0xf4a6980e, hlen=20, fin=0xf515dd14)
    at ../../../../netinet/ip_nat.c:1240
#7  0xf0172705 in fr_check (ip=0xf4a6980e, hlen=20, ifp=0xf083102c, out=0, 
    mp=0xf515dd80) at ../../../../netinet/fil.c:671
#8  0xf016834b in ipv4_input (m=0xf0beff00)
    at ../../../../netinet/ip_input.c:355
#9  0xf01681ac in ipintr () at ../../../../netinet/ip_input.c:249
#10 0xf0101fa5 in ?? ()
#11 0xf011d5be in tsleep (ident=0xf023ec08, priority=280, 
    wmesg=0xf0124d9b "select", timo=100) at ../../../../kern/kern_synch.c:364
#12 0xf0125119 in sys_select (p=0xf0b5d700, v=0xf515df88, retval=0xf515df80)
    at ../../../../kern/sys_generic.c:621
#13 0xf01b257e in syscall (frame={tf_es = 31, tf_ds = 31, tf_edi = -272639636, 
      tf_esi = -272639640, tf_ebp = -272639808, tf_ebx = -272639576, 
      tf_edx = 2, tf_ecx = 9, tf_eax = 93, tf_trapno = 3, tf_err = 2, 
      tf_eip = 1076271003, tf_cs = 23, tf_eflags = 582, tf_esp = -272639844, 
      tf_ss = 31, tf_vm86_es = 0, tf_vm86_ds = 0, tf_vm86_fs = 0, 
      tf_vm86_gs = 0}) at ../../../../arch/i386/i386/trap.c:727
#14 0xf0100e19 in ?? ()
can not access 0xefbfd8c0, invalid address (efbfd8c0)
can not access 0xefbfd8c0, invalid address (efbfd8c0)
Cannot access memory at address 0xefbfd8c0.
(gdb) quit

>How-To-Repeat:

>Fix:

>Audit-Trail:
>Unformatted: