Solaris 10 IP Filter state panic on unload

Hello,

I have been playing with IP Filter on a Solaris 10 SPARC machine.  I
have about 20-100mbps going through the machine with two NICs.  If I do
a ipf -D without taking down the network cards I get a kernel panic.

This problem occurs using older version of IP Filter like 4.1.X  (4.1.13
for example also has a similar panic).

I am running IP Filter v4.1.31, and pfil 2.1.13

-bash-3.00# uname -a
SunOS sun1 5.10 Generic_118833-33 sun4u sparc SUNW,Sun-Fire-V440
-bash-3.00# ipf -V
ipf: IP Filter: v4.1.31 (600)
Kernel: IP Filter: v4.1.31              
Running: yes
Log Flags: 0 = none set
Default: pass all, Logging: available
Active list: 1
Feature mask: 0x107
-bash-3.00# modinfo | grep pfil
119 7bb6a000   6438   -   1  pfil (pfil Streams module 2.1.13)
119 7bb6a000   6438 228   1  pfil (pfil Streams driver 2.1.13)
-bash-3.00# 

My IP Filter configuration is the following,

pass out quick
pass in quick proto tcp from any to any port = 80 keep state


I am trying to narrow down and fix the problem.  Has any one else had this problem?


panic[cpu0]/thread=2a100127cc0: mutex_destroy: bad mutex, lp=600096f2fc0 owner=30001fd6040 thread=2a100127cc0

000002a1001270a0 ipf:fr_delstate+390 (600096f2fc0, ffff, 0, 1, 8, 0)
  %l0-3: 000000000055aa55 0000000001188400 000000000000019c 0000000000000000
  %l4-7: 0000060000f53600 0000060000e8a040 0000000001040400 0000000001040400
000002a100127170 ipf:fr_statederef+9c (2a1001273c0, 2a10012731c, 2a100127320, 2, 0, 0)
  %l0-3: 00000000018ee870 0000060000dccf00 00000000018ee8b8 0000000000000001
  %l4-7: 0000000000000001 0000060000e8a040 0000000000000000 000000007bb45cc0
000002a100127240 ipf:fr_check+828 (60003182f10, 14, 60001405ed8, 0, 2a100127538, 2a1001277c8)
  %l0-3: 0000000080001607 0000000000000016 000000000002c8e3 0000000000000718
  %l4-7: 0000000000000000 0000000000000000 0000000000000000 000002a1001273c0
000002a100127460 pfil:pfil_precheck+c4c (60000e902a0, 2a1001277c8, 1, 60001405ed8, 60003182f10, 0)
  %l0-3: 0000000000000000 0000000000000100 0000000000000000 0000000000005640
  %l4-7: 0000000000000000 0000000000000001 0000000000000000 0000000000000100
000002a100127640 pfil:pfilmodrput+378 (60000e902a0, 60009137400, 2a100122000, 15, ffffffffffffffff, 0)
  %l0-3: 0000000000000000 0000000000000000 0000000010214030 0000000010214030
  %l4-7: 0000000000000106 00000000000005fa 0000000000000001 0000000001858000
000002a100127740 unix:putnext+218 (60000e90490, 60000e902a0, 60009137400, 100, 60000e907c0, 0)
  %l0-3: 0000000000000000 0000000000000000 0000000000000000 00000000000057f0
  %l4-7: 000000000000010d 000000007006de18 000000007bb6de74 fffffd5effede000
000002a1001277f0 ce:ce_rsrv+30 (60000e907c0, 60009137400, 30000f36000, 60000ebf380, 10214032, 100)
  %l0-3: 0000000000000000 0000000000000200 0000000000002000 0000000000002000
  %l4-7: 0000060000e909e8 0000000000000000 0000000000007fff 0000000000000200
000002a1001278a0 genunix:___const_seg_900000101+4de8 (60000e90828, 2a100127cc0, 2000, 60000e90828, 60000e907c0, 20000)
  %l0-3: fffffffffffffffe 00000000703833b0 0000000000000000 0000000000002200
  %l4-7: 0000000000000000 000000000001dc4a 00000000018a8400 0000000000000000
000002a100127950 genunix:___const_seg_900000101+ac6c (60000d63418, 300000e57c0, 60000c16888, 0, 60000d632c8, 60000e907c0)
  %l0-3: 000000000001dc4a 00000000018a8400 000002a100127cc0 7ffffffffffb1ab1
  %l4-7: 0000000000000000 0000000000000000 0000000000000001 00000000011aa000
000002a100127a00 genunix:taskq_d_thread+88 (60000c16888, 300000e57c0, 60000c116d0, 0, 12c7b5d0630, 60000c168b8)
  %l0-3: 00000300000e57d0 00000300000e5810 0000060000c116f0 0000000000007530
  %l4-7: 00000000018a8400 0000000000007530 0000000000000064 0000000001814000