Hit this bug on testing LKPI_80211_HW_CRYPTO in my private build. I am amazed it does not cause a panic/crash this time. === backtraces from dmesg (multiple cases) === ... [42.544686] wlan0: link state changed to UP [42.556806] iwlwifi0: _lkpi_iv_key_set_delete: set_key succeeded: keyidx 0 hw_key_idx 0 flags 0 [42.558904] uma_zalloc_debug: zone "malloc-64" with the following non-sleepable locks held: [42.559243] iwlwifi0: exclusive sleep mutex iwlwifi0_com_lo (iwlwifi0_com_lo) r = 0 (0xfffffe00ab444020) locked @ /usr/src/sys/net80211/ieee80211_scan_sw.c:436 [42.560370] stack backtrace: [42.560631] #0 0xffffffff80bc9475 at witness_debugger+0x65 [42.560985] _lkpi_iv_key_set_delete: set_key succeeded: keyidx 0 hw_key_idx 0 flags 0 [42.561791] #1 0xffffffff80bca5d9 at witness_warn+0x3e9 [42.562205] #2 0xffffffff80eeb184 at uma_zalloc_debug+0x34 [42.562640] #3 0xffffffff80eeac97 at uma_zalloc_arg+0x27 [42.563029] #4 0xffffffff80b273fe at malloc+0x7e [42.563388] #5 0xffffffff80de2192 at _lkpi_iv_key_set_delete+0x42 [42.563837] #6 0xffffffff80cd2124 at _ieee80211_crypto_delkey+0x74 [42.564287] #7 0xffffffff80cd208e at ieee80211_crypto_delkey+0x1e [42.564730] #8 0xffffffff80cfcdaa at ieee80211_node_delucastkey+0x3a [42.565192] #9 0xffffffff80cfb6d3 at ieee80211_sta_leave+0x13 [42.565605] #10 0xffffffff80d0eb80 at sta_newstate+0x100 [42.565994] #11 0xffffffff80dd839e at lkpi_sta_run_to_init+0x27e [42.566431] #12 0xffffffff80de1eeb at lkpi_iv_newstate+0x2db [42.566841] #13 0xffffffff80d06434 at ieee80211_newstate_cb+0x2a4 [42.567280] #14 0xffffffff80bbb37b at taskqueue_run_locked+0xab [42.567702] #15 0xffffffff80bbc433 at taskqueue_thread_loop+0xd3 [42.568129] #16 0xffffffff80b097e2 at fork_exit+0x82 [42.568509] #17 0xffffffff8102fffe at fork_trampoline+0xe [42.568814] lkpi_net80211_to_l80211_cipher_suite: unsupported cipher 0x00000006 [42.569296] wlan0: link state changed to DOWN [42.575649] iwlwifi0: cc: iwl_mvm_mld_free_sta_link mvm_sta->link[0] = 0xfffff800204114a8 [74.329729] wlan0: link state changed to UP [74.344199] iwlwifi0: _lkpi_iv_key_set_delete: set_key succeeded: keyidx 0 hw_key_idx 0 flags 0 [74.346195] uma_zalloc_debug: zone "malloc-64" with the following non-sleepable locks held: [74.346664] iwlwifi0: exclusive sleep mutex iwlwifi0_com_lo (iwlwifi0_com_lo) r = 0 (0xfffffe00ab444020) locked @ /usr/src/sys/net80211/ieee80211_scan_sw.c:436 [74.348324] stack backtrace: [74.348609] #0 0xffffffff80bc9475 at witnes_lkpi_iv_key_set_delete: set_key succeeded: keyidx 0 hw_key_idx 0 flags 0 [74.349676] s_debugger+0x65 [74.349803] #1 0xffffffff80bca5d9 at witness_warn+0x3e9 [74.350228] #2 0xffffffff80eeb184 at uma_zalloc_debug+0x34 [74.350665] #3 0xffffffff80eeac97 at uma_zalloc_arg+0x27 [74.351063] #4 0xffffffff80b273fe at malloc+0x7e [74.351422] #5 0xffffffff80de2192 at _lkpi_iv_key_set_delete+0x42 [74.351884] #6 0xffffffff80cd2124 at _ieee80211_crypto_delkey+0x74 [74.352351] #7 0xffffffff80cd208e at ieee80211_crypto_delkey+0x1e [74.352810] #8 0xffffffff80cfcdaa at ieee80211_node_delucastkey+0x3a [74.353287] #9 0xffffffff80cfb6d3 at ieee80211_sta_leave+0x13 [74.353725] #10 0xffffffff80d0eb80 at sta_newstate+0x100 [74.354127] #11 0xffffffff80dd839e at lkpi_sta_run_to_init+0x27e [74.354581] #12 0xffffffff80de1eeb at lkpi_iv_newstate+0x2db [74.355003] #13 0xffffffff80d06434 at ieee80211_newstate_cb+0x2a4 [74.355456] #14 0xffffffff80bbb37b at taskqueue_run_locked+0xab [74.355894] #15 0xffffffff80bbc433 at taskqueue_thread_loop+0xd3 [74.356336] #16 0xffffffff80b097e2 at fork_exit+0x82 [74.356728] #17 0xffffffff8102fffe at fork_trampoline+0xe [74.357047] lkpi_net80211_to_l80211_cipher_suite: unsupported cipher 0x00000006 [74.357767] wlan0: link state changed to DOWN [74.364907] iwlwifi0: cc: iwl_mvm_mld_free_sta_link mvm_sta->link[0] = 0xfffff80030123ca8