https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=289017
--- Comment #10 from Gui-Dong Han <[email protected]> --- (In reply to Gui-Dong Han from comment #7) Given that the transmit path can continue into the protocol's start function after lagg_proto_detach has executed (as evidenced by the crash above), and considering that detach explicitly frees protocol resources, I believe triggering a Use-After-Free (UAF) scenario is also highly probable with the specific timing. -- You are receiving this mail because: You are the assignee for the bug.
