Bug 139998

System boots up, then shortly after panics if I have all network devices plugged in.

GNU gdb 6.1.1 [FreeBSD]
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "amd64-marcel-freebsd"...

Unread portion of the kernel message buffer:


Fatal trap 12: page fault while in kernel mode
cpuid = 0; apic id = 00
fault virtual address	= 0x258
fault code		= supervisor read data, page not present
instruction pointer	= 0x8:0xffffffff803a18ad
stack pointer	        = 0x10:0xffffff807937a610
frame pointer	        = 0x10:0xffffff00038073a0
code segment		= base rx0, limit 0xfffff, type 0x1b
			= DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags	= interrupt enabled, resume, IOPL = 0
current process		= 1703 (snmpd)
trap number		= 12
panic: page fault
cpuid = 0
Uptime: 3m34s
Physical memory: 4084 MB
Dumping 1246 MB: 1231 1215 1199 1183 1167 1151 1135 1119 1103 1087 1071 1055 1039 1023 1007 991 975 959 943 927 911 895 879 863 847 831 815 799 783 767 751 735 719 703 687 671 655 639 623 607 591 575 559 543 527 511 495 479 463 447 431 415 399 383 367 351 335 319 303 287 271 255 239 223 207 191 175 159 143 127 111 95 79 63 47 31 15

Reading symbols from /boot/kernel/ipfw.ko...Reading symbols from /boot/kernel/ipfw.ko.symbols...done.
done.
Loaded symbols for /boot/kernel/ipfw.ko
#0  doadump () at pcpu.h:195
195		__asm __volatile("movq %%gs:0,%0" : "=r" (td));
(kgdb) back
#0  doadump () at pcpu.h:195
#1  0x0000000000000004 in ?? ()
#2  0xffffffff803af859 in boot (howto=260) at /usr/src/sys/kern/kern_shutdown.c:418
#3  0xffffffff803afc62 in panic (fmt=0x104 <Address 0x104 out of bounds>)
    at /usr/src/sys/kern/kern_shutdown.c:574
#4  0xffffffff80616233 in trap_fatal (frame=0xffffff00038073a0, eva=Variable "eva" is not available.
)
    at /usr/src/sys/amd64/amd64/trap.c:770
#5  0xffffffff80616605 in trap_pfault (frame=0xffffff807937a560, usermode=0)
    at /usr/src/sys/amd64/amd64/trap.c:686
#6  0xffffffff80616f44 in trap (frame=0xffffff807937a560) at /usr/src/sys/amd64/amd64/trap.c:457
#7  0xffffffff80600dbe in calltrap () at /usr/src/sys/amd64/amd64/exception.S:218
#8  0xffffffff803a18ad in _mtx_lock_sleep (m=0xffffff00039916e8, tid=18446742974256673696, opts=Variable "opts" is not available.
)
    at /usr/src/sys/kern/kern_mutex.c:339
#9  0xffffffff80462abc in rtrequest1_fib (req=11, info=0xffffff807937a6d0, 
    ret_nrt=0xffffff807937a7f8, fibnum=0) at /usr/src/sys/net/route.c:1045
#10 0xffffffff8046342d in rtrequest_fib (req=11, dst=0xffffff807937a8d8, gateway=0x0, netmask=0x0, 
    flags=0, ret_nrt=0xffffff807937a7f8, fibnum=0) at /usr/src/sys/net/route.c:738
#11 0xffffffff804638c1 in rtalloc1_fib (dst=0xffffff807937a8d8, report=1, 
    ignflags=18446744073709551615, fibnum=0) at /usr/src/sys/net/route.c:315
#12 0xffffffff80464ad9 in rtalloc_ign_fib (ro=0xffffff807937a8d0, ignore=0, fibnum=0)
    at /usr/src/sys/net/route.c:252
#13 0xffffffff8049f31d in ip_output (m=0xffffff0003ddeb00, opt=0x0, ro=0xffffff807937a8d0, 
    flags=0, imo=0x0, inp=0xffffff000396d900) at /usr/src/sys/netinet/ip_output.c:230
#14 0xffffffff8050f26b in udp_send (so=Variable "so" is not available.
) at /usr/src/sys/netinet/udp_usrreq.c:1100
#15 0xffffffff8040ce61 in sosend_dgram (so=0xffffff0003d422d0, addr=0x0, uio=Variable "uio" is not available.
)
    at /usr/src/sys/kern/uipc_socket.c:1060
#16 0xffffffff80411a37 in kern_sendit (td=0xffffff00038073a0, s=11, mp=0xffffff807937ab10, 
    flags=0, control=0x0, segflg=Variable "segflg" is not available.
) at /usr/src/sys/kern/uipc_syscalls.c:805
#17 0xffffffff804149af in sendit (td=0xffffff00038073a0, s=11, mp=0xffffff807937ab10, flags=0)
    at /usr/src/sys/kern/uipc_syscalls.c:742
#18 0xffffffff80414aaf in sendto (td=Variable "td" is not available.
) at /usr/src/sys/kern/uipc_syscalls.c:857
#19 0xffffffff80616887 in syscall (frame=0xffffff807937ac80) at /usr/src/sys/amd64/amd64/trap.c:913
#20 0xffffffff80600fcb in Xfast_syscall () at /usr/src/sys/amd64/amd64/exception.S:339
#21 0x000000080168568c in ?? ()
Previous frame inner to this frame (corrupt stack?)
(kgdb)

Fix: 

??
How-To-Repeat: Can re-create at will on my machine.  Have CARP, IPFW, and routed running on a lot of interfaces.