This command sequence causes infinite recursion in pfi_kkif_update(), so it runs out of stack: # kldload if_wg # kldload pf # ifconfig wg0 create # ifconfig wg0 name wg Fatal double fault rip 0xffffffff82e6a2b6 rsp 0xfffffe00d71aefe0 rbp 0xfffffe00d71af030 rax 0x1f91c764d934a9f6 rdx 0 rbx 0xfffff80019d23900 rcx 0xfffff800191e7100 rsi 0xffffffff8220bf80 rdi 0xfffff800191e7100 r8 0xfffff800556cd5c8 r9 0x1a10010 r10 0 r11 0x1 r12 0xffffffff81b99828 r13 0xffffffff81b99828 r14 0 r15 0xfffff8000f289000 rflags 0x10282 cs 0x20 ss 0x28 ds 0x3b es 0x3b fs 0x13 gs 0x1b fsbase 0x397eefe143b0 gsbase 0xffffffff82a11000 kgsbase 0 cpuid = 1; apic id = 01 panic: double fault cpuid = 1 time = 1785578874 KDB: stack backtrace: db_trace_self_wrapper() at db_trace_self_wrapper+0x36/frame 0xfffffe001c472cd0 vpanic() at vpanic+0x149/frame 0xfffffe001c472e00 panic() at panic+0x43/frame 0xfffffe001c472e60 cpu_fetch_syscall_args() at cpu_fetch_syscall_args/frame 0xfffffe001c472f20 Xdblfault() at Xdblfault+0xd7/frame 0xfffffe001c472f20 --- trap 0x17, rip = 0xffffffff82e6a2b6, rsp = 0xfffffe00d71aefe0, rbp = 0xfffffe00d71af030 --- pfi_kkif_update() at pfi_kkif_update+0x26/frame 0xfffffe00d71af030 pfi_kkif_update() at pfi_kkif_update+0x2ba/frame 0xfffffe00d71af090 pfi_kkif_update() at pfi_kkif_update+0x2ba/frame 0xfffffe00d71af0f0 pfi_kkif_update() at pfi_kkif_update+0x2ba/frame 0xfffffe00d71af150 pfi_kkif_update() at pfi_kkif_update+0x2ba/frame 0xfffffe00d71af1b0 pfi_kkif_update() at pfi_kkif_update+0x2ba/frame 0xfffffe00d71af210 ... pfi_kkif_update() at pfi_kkif_update+0x2ba/frame 0xfffffe00d71b29f0 pfi_attach_ifnet_event() at pfi_attach_ifnet_event+0x91/frame 0xfffffe00d71b2a50 if_rename() at if_rename+0x203/frame 0xfffffe00d71b2ad0 ifhwioctl() at ifhwioctl+0xc57/frame 0xfffffe00d71b2bc0 ifioctl() at ifioctl+0x702/frame 0xfffffe00d71b2cc0 kern_ioctl() at kern_ioctl+0x2bd/frame 0xfffffe00d71b2d30 sys_ioctl() at sys_ioctl+0x12f/frame 0xfffffe00d71b2df0 amd64_syscall() at amd64_syscall+0x17c/frame 0xfffffe00d71b2f30 fast_syscall_common() at fast_syscall_common+0xf8/frame 0xfffffe00d71b2f30 --- syscall (54, FreeBSD ELF64, ioctl), rip = 0xff79713d48a, rsp = 0xff790379a78, rbp = 0xff790379ad0 ---
The root problem here is arguably not in pf but in the network stack interface rename code. Pf assumes that network groups and network interfaces share a namespace. This used to be true, but the assumption was broken when renaming interfaces was introduced. That’s what causes the confusion here, and the panic. I thought I’d hacked it up enough to at least avoid the panic, but clearly there are still broken scenarios. I’ll see if I can at least avoid the panic, but realistically the behaviour will still be buggy until the network stack itself is fixed. (There are other bug reports about this, but I don’t have the numbers at hand.)
A commit in branch main references this bug: URL: https://cgit.FreeBSD.org/src/commit/?id=d2a5b5a86a92e86f77737273ab4b2e99da63c21d commit d2a5b5a86a92e86f77737273ab4b2e99da63c21d Author: Kristof Provost <kp@FreeBSD.org> AuthorDate: 2026-08-03 14:05:28 +0000 Commit: Kristof Provost <kp@FreeBSD.org> CommitDate: 2026-08-03 16:01:52 +0000 pf: attempt to handle overlapping group and interface names pf assumes that network groups and network interfaces share a namespace (that is, a name is unused, a group or an interface, never both a the same time). Unfortunately this assumption was broken when interface renaming was introduced. Attempt to cope with this rather than panicking. Note that this is a band-aid, not a full solution. The correct fix is for the network stack to go back to enforcing a single namespace for groups and interfaces. PR: 297220 Reported by: Robert Morris MFC after: 1 week Sponsored by: Rubicon Communications, LLC ("Netgate") sys/netpfil/pf/pf_if.c | 19 +++++++++++++------ tests/sys/netpfil/pf/names.sh | 23 +++++++++++++++++++++++ 2 files changed, 36 insertions(+), 6 deletions(-)
A commit in branch stable/15 references this bug: URL: https://cgit.FreeBSD.org/src/commit/?id=80d732d6409907efb586c621238f5c43c77690f8 commit 80d732d6409907efb586c621238f5c43c77690f8 Author: Kristof Provost <kp@FreeBSD.org> AuthorDate: 2026-08-03 14:05:28 +0000 Commit: Kristof Provost <kp@FreeBSD.org> CommitDate: 2026-08-11 08:33:56 +0000 pf: attempt to handle overlapping group and interface names pf assumes that network groups and network interfaces share a namespace (that is, a name is unused, a group or an interface, never both a the same time). Unfortunately this assumption was broken when interface renaming was introduced. Attempt to cope with this rather than panicking. Note that this is a band-aid, not a full solution. The correct fix is for the network stack to go back to enforcing a single namespace for groups and interfaces. PR: 297220 Reported by: Robert Morris MFC after: 1 week Sponsored by: Rubicon Communications, LLC ("Netgate") (cherry picked from commit d2a5b5a86a92e86f77737273ab4b2e99da63c21d) sys/netpfil/pf/pf_if.c | 19 +++++++++++++------ tests/sys/netpfil/pf/names.sh | 23 +++++++++++++++++++++++ 2 files changed, 36 insertions(+), 6 deletions(-)
A commit in branch stable/14 references this bug: URL: https://cgit.FreeBSD.org/src/commit/?id=71ac7ff5d6f97d0f49b72922bcaca191ff7677d2 commit 71ac7ff5d6f97d0f49b72922bcaca191ff7677d2 Author: Kristof Provost <kp@FreeBSD.org> AuthorDate: 2026-08-03 14:05:28 +0000 Commit: Kristof Provost <kp@FreeBSD.org> CommitDate: 2026-08-11 08:34:13 +0000 pf: attempt to handle overlapping group and interface names pf assumes that network groups and network interfaces share a namespace (that is, a name is unused, a group or an interface, never both a the same time). Unfortunately this assumption was broken when interface renaming was introduced. Attempt to cope with this rather than panicking. Note that this is a band-aid, not a full solution. The correct fix is for the network stack to go back to enforcing a single namespace for groups and interfaces. PR: 297220 Reported by: Robert Morris MFC after: 1 week Sponsored by: Rubicon Communications, LLC ("Netgate") (cherry picked from commit d2a5b5a86a92e86f77737273ab4b2e99da63c21d) sys/netpfil/pf/pf_if.c | 19 +++++++++++++------ tests/sys/netpfil/pf/names.sh | 23 +++++++++++++++++++++++ 2 files changed, 36 insertions(+), 6 deletions(-)