Patch and further info can be found here: https://reviews.freebsd.org/D3855 See also: https://svnweb.freebsd.org/base?view=revision&revision=292254 MFC was set to 1 week in mid Dec 2015. Patch applies, compiles and successfully prevents kldunload panics for dummynet (as tested on 10.2-RELEASE).
Over to committer of r292254.
A commit references this bug: Author: hselasky Date: Thu Mar 24 09:22:59 UTC 2016 New revision: 297228 URL: https://svnweb.freebsd.org/changeset/base/297228 Log: MFC r292254: Properly drain callouts in the IPFW subsystem to avoid use after free panics when unloading the dummynet and IPFW modules: - The callout drain function can sleep and should not be called having a non-sleepable lock locked. Remove locks around "ipfw_dyn_uninit(0)". - Add a new "dn_gone" variable to prevent asynchronous restart of dummynet callouts when unloading the dummynet kernel module. - Call "dn_reschedule()" locked so that "dn_gone" can be set and checked atomically with regard to starting a new callout. PR: 208171 Requested by: Franco Fichtner (opnsense.org) Differential Revision: https://reviews.freebsd.org/D3855 Changes: _U stable/10/ stable/10/sys/netpfil/ipfw/ip_dn_io.c stable/10/sys/netpfil/ipfw/ip_dummynet.c stable/10/sys/netpfil/ipfw/ip_fw2.c