panic in pf_purge_expired_states

["Simon 'corecode' Schubert" <corecode@xxxxxxxxxxxx>]

hey,

about every month i'm getting a panic in pf_purge_expired_states on some 
RB_* function.

I talked to dhartmei and he said that there are no problems known to 
this code, except for reentrancy issues.

So I wonder: how can the RB-tree be destroyed?  Probably some race 
between the timer and the network.  But can that be?  The timer runs in 
a critical section, and shouldn't the network too?

several crash dumps available on request.

and clues?

thanks
  simon

--
Serve - BSD     +++  RENT this banner advert  +++    ASCII Ribbon   /"\
Work - Mac      +++  space for low €€€ NOW!1  +++      Campaign     \ /
Party Enjoy Relax   |   http://dragonflybsd.org      Against  HTML   \
Dude 2c 2 the max   !   http://golden-apple.biz       Mail + News   / \