kernel crash in tcp_subr.c:2386

Hi,

I got a coredump with sources from 2024-02-10-144617 (GMT+0100):
---snip---
__curthread () at /space/system/usr_src/sys/amd64/include/pcpu_aux.h:57
57              __asm("movq %%gs:%P1,%0" : "=r" (td) : "n" (offsetof(struct
pcpu,
(kgdb) #0  __curthread () at
/space/system/usr_src/sys/amd64/include/pcpu_aux.h:57
        td = <optimized out>
#1  doadump (textdump=textdump@entry=1)
    at /space/system/usr_src/sys/kern/kern_shutdown.c:403
        error = 0
        coredump = <optimized out>
#2  0xffffffff8052fe85 in kern_reboot (howto=260)
    at /space/system/usr_src/sys/kern/kern_shutdown.c:521
        once = 0
        __pc = <optimized out>
#3  0xffffffff80530382 in vpanic (
    fmt=0xffffffff808df476 "Assertion %s failed at %s:%d",
    ap=ap@entry=0xfffffe08a079ebf0)
    at /space/system/usr_src/sys/kern/kern_shutdownc:973
        buf = "Assertion !callout_active(&tp->t_callout) failed at
/space/system/usr_src/sys/netinet/tcp_subr.c:2386", '\000' <repeats 154
times>
        __pc = <optimized out>
        __pc = <optimized out>
        __pc = <optimized out>
        other_cpus = {__bits = {14680063, 0 <repeats 15 times>}}
        td = 0xfffff8068ef99740
        bootopt = <unavailable>
        newpanic = <optimized out>
#4  0xffffffff805301d3 in panic (fmt=<unavailable>)
    at /space/system/usr_src/sys/kern/kern_shutdown.c:889
        ap = {{gp_offset = 32, fp_offset = 48,
            overflow_arg_area = 0xfffffe08a079ec20,
            reg_save_area = 0xfffffe08a079ebc0}}
#5  0xffffffff806c9d8c in tcp_discardcb (tp=tp@entry=0xfffff80af441ba80)
    at /space/system/usr_src/sys/netinet/tcp_subr.c:2386
        inp = 0xfffff80af441ba80
        so = 0xfffff804d23d2780
        m = <optimized out>
        isipv6 = <optimized out>
#6  0xffffffff806d6291 in tcp_usr_detach (so=0xfffff804d23d2780)
    at /space/system/usr_src/sys/netinet/tcp_usrreq.c:214
        inp = 0xfffff80af441ba80
        tp = 0xfffff80af441ba80
#7  0xffffffff805dba57 in sofree (so=0xfffff804d23d2780)
    at /space/system/usr_src/sys/kern/uipc_socket.c:1205
        pr = 0xffffffff80a8bd18 <tcp_protosw>
#8  sorele_locked (so=so@entry=0xfffff804d23d2780)
    at /space/system/usr_src/sys/kern/uipc_socket.c:1232
No locals.
#9  0xffffffff805dc8c0 in soclose (so=0xfffff804d23d2780)
    at /space/system/usr_src/sys/kern/uipc_socket.c:1302
        lqueue = {tqh_first = 0xfffff8068ef99740,
          tqh_last = 0xfffffe08a079ed40}
        error = 0
        saved_vnet = 0x0
        last = <optimized out>
        listening = <optimized out>
#10 0xffffffff804ccbd1 in fo_close (fp=0xfffff805f2dfc500, td=<unavailable>)
    at /space/system/usr_src/sys/sys/file.h:390
No locals.
#11 _fdrop (fp=fp@entry=0xfffff805f2dfc500, td=<unavailable>,
    td@entry=0xfffff8068ef99740)
    at /space/system/usr_src/sys/kern/kern_descrip.c:3666
        count = <unavailable>
        error = <optimized out>
#12 0xffffffff804d02f3 in closef (fp=fp@entry=0xfffff805f2dfc500,
    td=td@entry=0xfffff8068ef99740)
    at /space/system/usr_src/sys/kern/kern_descrip.c:2839
        _error = 0
        _fp = 0xfffff805f2dfc500
        lf = {l_start = -8791759350504, l_len = -8791759350528, l_pid = 0,
          l_type = 0, l_whence = 0, l_sysid = 0}
        vp = <optimized out>
        fdtol = <optimized out>
        fdp = <optimized out>
#13 0xffffffff804cd50c in closefp_impl (fdp=0xfffffe07afebf860, fd=19,
    fp=0xfffff805f2dfc500, td=0xfffff8068ef99740, audit=<optimized out>)
    at /space/system/usr_src/sys/kern/kern_descrip.c:1315
        error = <optimized out>
#14 closefp (fdp=0xfffffe07afebf860, fd=19, fp=0xfffff805f2dfc500,
    td=0xfffff8068ef99740, holdleaders=true, audit=<optimized out>)
    at /space/system/usr_src/sys/kern/kern_descrip.c:1372
No locals.
#15 0xffffffff808597d6 in syscallenter (td=0xfffff8068ef99740)
    at /space/system/usr_src/sys/amd64/amd64/../../kern/subr_syscall.c:186
        se = 0xffffffff80a48330 <sysent+192>
        p = 0xfffffe07f29995c0
        sa = 0xfffff8068ef99b30
        error = <optimized out>
        sy_thr_static = <optimized out>
        traced = <optimized out>
#16 amd64_syscall (td=0xfffff8068ef99740, traced=0)
    at /space/system/usr_src/sys/amd64/amd64/trap.c:1192
        ksi = {ksi_link = {tqe_next = 0xfffffe08a079ef30,
            tqe_prev = 0xffffffff808588af <trap+2351>}, ksi_info = {
            si_signo = 1, si_errno = 0, si_code = 2015268872, si_pid = -512,
            si_uid = 2398721856, si_status = -2042,
            si_addr = 0xfffffe08a079ef40, si_value = {sival_int =
-1602621824,
              sival_ptr = 0xfffffe08a079ee80, sigval_int = -1602621824,
              sigval_ptr = 0xfffffe08a079ee80}, _reason = {_fault = {
                _trapno = 1489045984}, _timer = {_timerid = 1489045984,
                _overrun = 17999}, _mesgq = {_mqd = 1489045984}, _poll = {
                _band = 77306605406688}, _capsicum = {_syscall =
1489045984},
              __spare__ = {__spare1__ = 77306605406688, __spare2__ = {
                  1489814048, 17999, 208, 0, 0, 0, 992191072}}}},
          ksi_flags = 975329968, ksi_sigq = 0xffffffff8082f8f3
<Xinvlop+179>}
#17 <signal handler called>
No locals.
#18 0x00003af13b17fc9a in ?? ()
No symbol table info available.
Backtrace stopped: Cannot access memory at address 0x3af13a225ab8
---snip---

Any ideas?

Due to another issue in userland, I updated to 2024-02-11-212006, but I
have the above mentioned version and core still in a BE if needed.

Bye,
Alexander.