Kernel panic with IPSec bridge

[Jon Parise <jon_(_at_)_csh_(_dot_)_rit_(_dot_)_edu>]

I'm running an IPSec bridge similar to the one described in
brconfig(8).  Everything works fine, with the exception of the
occasional kernel panic.

What follows is the ddb output:

multiply freed item 0xf84c6600
panic: free: duplicated free
Stopped at      _Debugger+0x4:  jmpl            [%o7 + 0x8], %g0
Run at least 'trace' and 'ps' and include the output when
reporting this panic.

ddb> trace
_free(0xf84c6600, 0x7f, 0x2, 0x700, 0xf800f200, 0x980) at _free+0x1c4
_am7990_put(0x42, 0x6d02, 0xf8464180, 0x60c0, 0xf800f228, 0x0) at _am7990_put+0x300
_am7990_start(0xf844c630, 0xf800ed74, 0xffffffff, 0xf843dcb0, 0xffffff81, 0x1) at _am7990_start+0x54
_ether_output(0xf844c630, 0xf84d4500, 0xf843dcb0, 0xf84910f0, 0xf807db88, 0xf8481200) at _ether_output+0x594
_ip_output(0xf84d4500, 0x100, 0x0, 0xf84d4520, 0x0, 0x0) at _ip_output+0xaa8
_ipsp_process_done(0xf84d4500, 0x2, 0x0, 0x14, 0x51, 0x0) at _ipsp_process_done+0xf8
_esp_output_cb(0xf84d0500, 0xf80cf894, 0x0, 0xfa105d94, 0x5c5c5c5c, 0x5c5c5c5c) at _esp_output_cb+0x16c
_crypto_done(0xf84d0500, 0xf843d5a0, 0xf84d4500, 0x2, 0xf849f500, 0xf81f6ab8) at _crypto_done+0x8
_swcr_process(0x0, 0xf80e2aa8, 0xf849f500, 0x4, 0x0, 0x2) at _swcr_process+0x16c
_crypto_invoke(0x0, 0x0, 0xf80e1a40, 0x0, 0xf84d0500, 0x0) at _crypto_invoke+0x144
_crypto_thread(0xfa0fa3c0, 0xf805e400, 0xf8201800, 0xf81bac00, 0xf81d4000, 0x0) at _crypto_thread+0x74
_start_crypto(0x0, 0x200, 0xf80072f4, 0xf81eb188, 0xfa0f9b74, 0x2000) at _start_crypto+0x4
_proc_trampoline(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) at _proc_trampoline

ddb> ps
  PID   PPID   PGRP    UID  S       FLAGS  WAIT       COMMAND
 22281      1  22281      0  3      0x4086  ttyin      getty
 11439      1  11439      0  3        0x84  nanosleep  cron
 30667      1  30667      0  3        0x84  select     sshd
 19217      1  19217     70  3       0x184  select     named
  6748      1   6748      0  2        0x84             syslogd
  8781      1   8781      0  3        0x84  select     dhclient
*    5      0      0      0  2    0x100204             crypto
     4      0      0      0  3    0x100204  syncer     update
     3      0      0      0  3    0x100204  reaper     reaper
     2      0      0      0  3    0x100204  daemon_sl  pagedaemon
     1      0      1      0  3      0x4084  wait       init
     0     -1      0      0  3     0x80204  scheduler  swapper

An inspection of the kernel core file later on yields the
following backtrace:

#0  0xf819c284 in dumpsys ()
    at /usr/src/sys/arch/sparc/compile/SPORK/../../../../arch/sparc/sparc/machdep.c:926
#1  0xf819c090 in boot (howto=256)
    at /usr/src/sys/arch/sparc/compile/SPORK/../../../../arch/sparc/sparc/machdep.c:842
#2  0xf8037124 in log ()
#3  0xf802a69c in free ()
#4  0xf800e3a4 in am7990_put ()
#5  0xf800edd0 in am7990_start ()
#6  0xf807e124 in ether_output ()
#7  0xf80ad39c in ip_output ()
#8  0xf80ce4f4 in ipsp_process_done ()
#9  0xf80cfa08 in esp_output_cb ()
#10 0xf80e1af8 in crypto_done ()
#11 0xf80e2c1c in swcr_process ()
#12 0xf80e17f8 in crypto_invoke ()
#13 0xf80e1ac8 in crypto_thread ()
#14 0xf802054c in start_crypto ()

The machine in question is a SS10 (sparc) running OpenBSD
2.9-stable.

I'd like to get this solved as soon as possible, so any guidance
would be muchly appreciated.  I can't produce these panics on
demand, but they appear to occur fairly often (although
irregularly).

-- 
Jon Parise (jon_(_at_)_csh_(_dot_)_rit_(_dot_)_edu)  .  Rochester Inst. of Technology
http://www.csh.rit.edu/~jon/  :  Computer Science House Member