diff --git a/sys/netgraph/fec/ng_fec.c b/sys/netgraph/fec/ng_fec.c --- a/sys/netgraph/fec/ng_fec.c +++ b/sys/netgraph/fec/ng_fec.c @@ -406,6 +406,10 @@ /* Add to the queue */ new->fec_if = bifp; + /* DF-0524: DragonFly has no if_ref()/if_rele(). The stored raw pointer + * becomes dangling if the member interface is detached. Proper fix: + * register an ifnet_detach_event EVENTHANDLER to NULL out fec_if on + * interface removal, and check fec_if != NULL before dereferencing. */ TAILQ_INSERT_TAIL(&b->ng_fec_ports, new, fec_list); ifnet_unlock();