Solaris 10 x86 u6 kernel panic with ipf

I'm getting kernel panics from ipf (I believe) as follow

> Sep  8 16:46:20 pianeta genunix: [ID 335743 kern.notice] BAD TRAP: 
> type=e (#pf Page fault) rp=fffffe80000b32a0 addr=0 occurred in module 
> "ip" due to a NULL pointer dereference
> Sep  8 16:46:20 pianeta unix: [ID 100000 kern.notice]
> Sep  8 16:46:20 pianeta unix: [ID 839527 kern.notice] sched:
> Sep  8 16:46:20 pianeta unix: [ID 753105 kern.notice] #pf Page fault
> Sep  8 16:46:20 pianeta unix: [ID 532287 kern.notice] Bad kernel fault 
> at addr=0x0
> Sep  8 16:46:20 pianeta unix: [ID 243837 kern.notice] pid=0, 
> pc=0xffffffffef7e8f56, sp=0xfffffe80000b3390, eflags=0x10246
> Sep  8 16:46:20 pianeta unix: [ID 211416 kern.notice] cr0: 
> 8005003b<pg,wp,ne,et,ts,mp,pe> cr4: 6f0<xmme,fxsr,pge,mce,pae,pse>
> Sep  8 16:46:20 pianeta unix: [ID 354241 kern.notice] cr2: 0 cr3: 
> 10f51000 cr8: c
> Sep  8 16:46:20 pianeta unix: [ID 592667 kern.notice]   rdi: 
> ffffffff98b2e0b8 rsi:                0 rdx: fffffe80000b33e0
> Sep  8 16:46:20 pianeta unix: [ID 592667 kern.notice]   
> rcx:                0  r8:                0  r9:                0
> Sep  8 16:46:20 pianeta unix: [ID 592667 kern.notice]   
> rax:                0 rbx: fffffe84f1b59930 rbp: fffffe80000b33a0
> Sep  8 16:46:20 pianeta unix: [ID 592667 kern.notice]   
> r10:               14 r11: fffffe84cf92b018 r12: ffffffff9990e6c0
> Sep  8 16:46:20 pianeta unix: [ID 592667 kern.notice]   r13: 
> ffffffff99ca7dc0 r14: fffffe80000b39e0 r15:                0
> Sep  8 16:46:20 pianeta unix: [ID 592667 kern.notice]   fsb: 
> ffffffff80000000 gsb: fffffffffbc297c0  ds:               43
> Sep  8 16:46:20 pianeta unix: [ID 592667 kern.notice]    
> es:               43  fs:                0  gs:              1c3
> Sep  8 16:46:20 pianeta unix: [ID 592667 kern.notice]   
> trp:                e err:                0 rip: ffffffffef7e8f56
> Sep  8 16:46:20 pianeta unix: [ID 592667 kern.notice]    
> cs:               28 rfl:            10246 rsp: fffffe80000b3390
> Sep  8 16:46:20 pianeta unix: [ID 266532 kern.notice]    
> ss:               30
> Sep  8 16:46:20 pianeta unix: [ID 100000 kern.notice]
> Sep  8 16:46:20 pianeta genunix: [ID 655072 kern.notice] 
> fffffe80000b31b0 unix:die+da ()
> Sep  8 16:46:20 pianeta genunix: [ID 655072 kern.notice] 
> fffffe80000b3290 unix:trap+5e6 ()
> Sep  8 16:46:20 pianeta genunix: [ID 655072 kern.notice] 
> fffffe80000b32a0 unix:cmntrap+140 ()
> Sep  8 16:46:20 pianeta genunix: [ID 655072 kern.notice] 
> fffffe80000b33a0 ip:ip_routeto+6 ()
> Sep  8 16:46:20 pianeta genunix: [ID 655072 kern.notice] 
> fffffe80000b3400 ipf:qif_illrouteto+70 ()
> Sep  8 16:46:20 pianeta genunix: [ID 655072 kern.notice] 
> fffffe80000b3500 ipf:fr_fastroute+1ec ()
> Sep  8 16:46:20 pianeta genunix: [ID 655072 kern.notice] 
> fffffe80000b3690 ipf:fr_send_ip+21b ()
> Sep  8 16:46:20 pianeta genunix: [ID 655072 kern.notice] 
> fffffe80000b36f0 ipf:fr_send_reset+2ef ()
> Sep  8 16:46:20 pianeta genunix: [ID 655072 kern.notice] 
> fffffe80000b3870 ipf:fr_check+727 ()
> Sep  8 16:46:20 pianeta genunix: [ID 655072 kern.notice] 
> fffffe80000b3900 ipf:ipf_hook+11e ()
> Sep  8 16:46:20 pianeta genunix: [ID 655072 kern.notice] 
> fffffe80000b3940 hook:hook_run+6c ()
> Sep  8 16:46:20 pianeta genunix: [ID 655072 kern.notice] 
> fffffe80000b3a60 ip:ip_input+3bb ()
> Sep  8 16:46:20 pianeta genunix: [ID 655072 kern.notice] 
> fffffe80000b3b30 dls:i_dls_link_rx+32e ()
> Sep  8 16:46:20 pianeta genunix: [ID 655072 kern.notice] 
> fffffe80000b3b80 mac:mac_rx+71 ()
> Sep  8 16:46:20 pianeta genunix: [ID 655072 kern.notice] 
> fffffe80000b3bd0 e1000g:e1000g_intr_work+d9 ()
> Sep  8 16:46:20 pianeta genunix: [ID 655072 kern.notice] 
> fffffe80000b3bf0 e1000g:e1000g_intr_pciexpress+70 ()
> Sep  8 16:46:20 pianeta genunix: [ID 655072 kern.notice] 
> fffffe80000b3c40 unix:av_dispatch_autovect+78 ()
> Sep  8 16:46:20 pianeta genunix: [ID 655072 kern.notice] 
> fffffe80000b3c50 unix:intr_thread+5f ()
> Sep  8 16:46:20 pianeta unix: [ID 100000 kern.notice]
> Sep  8 16:46:20 pianeta genunix: [ID 672855 kern.notice] syncing file 
> systems...
The current ipf running is

>    PKGINST:  ipf
>       NAME:  IP Filter
>   CATEGORY:  system
>       ARCH:  i386
>    VERSION:  4.1.32
>    BASEDIR:  /
>     VENDOR:  Darren Reed
>       DESC:  This package contains tools for building a firewall
>   INSTDATE:  Aug 25 2009 14:45
>      EMAIL:  [email protected]
>     STATUS:  completely installed
>      FILES:      100 installed pathnames
>                   13 shared pathnames
>                    7 linked files
>                   26 directories
>                   12 executables
>                 2889 blocks used (approx)
and these are the (simple,old and weak) rules

> # APC WebServer
>  block return-rst in quick proto tcp from any to pianeta port = 3052
>  block return-rst in quick proto udp from any to pianeta port = 517
>  block return-rst in quick proto tcp from any to pianeta port = 898
> # Biff Server
>  pass  in quick proto udp from pianeta to pianeta port = 512
>  block in quick proto udp from any to pianeta port = 512
> # Snmp Server
>  block in quick proto udp from any to pianeta port = 161
>  block in quick proto udp from any to pianeta port = 162
> #
Any hints or ideas ??

The system is patched to the latest official patch released by sun.

-- 
Ing. Sergio Rabellino

Università degli Studi di Torino
Dipartimento di Informatica
ICT Services Director
Tel +39-0116706701  Fax +39-011751603
C.so Svizzera , 185 - 10149 - Torino

<http://www.di.unito.it>