On 05/29/18 13:20, Andriy Gapon wrote: > (kgdb) p *$4.lh_first->c_links.le.le_next > $6 = { > c_links = { > le = { > le_next = 0x0, > le_prev = 0xfffffe0003999f98 Where does the le_prev point? Typically happens when callouts are not properly drained before freeing memory. --HPS