Submitting Crash Report

[faysalmehmood]

Today, the pfsense 2.7 (snapshot version) crashed and couldn't recover despite multiple reboots. The dump files are attached in below zipped file.
crash report.zip

[jimp]

Both of those crashes are different but appear to be in PPPoE and netgraph.

They don't quite line up with other similar recent issues either.

First panic backtrace:

db:0:kdb.enter.default>  bt
Tracing pid 0 tid 100007 td 0xfffffe0012e2c720
kdb_enter() at kdb_enter+0x32/frame 0xfffffe001099f960
vpanic() at vpanic+0x183/frame 0xfffffe001099f9b0
panic() at panic+0x43/frame 0xfffffe001099fa10
pppoe_addsession() at pppoe_addsession+0xb1/frame 0xfffffe001099fa40
ng_pppoe_rcvdata_ether() at ng_pppoe_rcvdata_ether+0x8ba/frame 0xfffffe001099fad0
ng_apply_item() at ng_apply_item+0x2de/frame 0xfffffe001099fb70
ng_snd_item() at ng_snd_item+0x2e0/frame 0xfffffe001099fbb0
ether_demux() at ether_demux+0x1a4/frame 0xfffffe001099fbe0
ether_nh_input() at ether_nh_input+0x349/frame 0xfffffe001099fc30
netisr_dispatch_src() at netisr_dispatch_src+0xad/frame 0xfffffe001099fc90
ether_input() at ether_input+0x99/frame 0xfffffe001099fcf0
iflib_rxeof() at iflib_rxeof+0xe59/frame 0xfffffe001099fe00
_task_fn_rx() at _task_fn_rx+0x7a/frame 0xfffffe001099fe40
gtaskqueue_run_locked() at gtaskqueue_run_locked+0xa7/frame 0xfffffe001099fec0
gtaskqueue_thread_loop() at gtaskqueue_thread_loop+0xc2/frame 0xfffffe001099fef0
fork_exit() at fork_exit+0x80/frame 0xfffffe001099ff30
fork_trampoline() at fork_trampoline+0xe/frame 0xfffffe001099ff30

First panic message buffer:

<5>ng_pppoe[15]: no matching session
panic: Bad list head 0xfffffe0096ade060 first->prev != head
cpuid = 0
time = 1685171251
KDB: enter: panic

Second panic backtrace:

Tracing pid 13 tid 100046 td 0xfffffe0012ec4020
kdb_enter() at kdb_enter+0x32/frame 0xfffffe00858c9cf0
vpanic() at vpanic+0x183/frame 0xfffffe00858c9d40
panic() at panic+0x43/frame 0xfffffe00858c9da0
ng_destroy_hook() at ng_destroy_hook+0x309/frame 0xfffffe00858c9de0
ng_apply_item() at ng_apply_item+0x97/frame 0xfffffe00858c9e80
ngthread() at ngthread+0x26b/frame 0xfffffe00858c9ef0
fork_exit() at fork_exit+0x80/frame 0xfffffe00858c9f30
fork_trampoline() at fork_trampoline+0xe/frame 0xfffffe00858c9f30

Second panic message buffer:

panic: refcount 0xfffff800188fd2a8 wraparound
cpuid = 3
time = 1685245381
KDB: enter: panic