Hi! My 11.0-STABLE/i386 r311924 debugging kernel catches _rm_assert(rm, RA_RLOCKED, file, line) in sys/netpfil/ipfw:ipfw_chk() function trying to do IPFW_PF_RUNLOCK(chain) on an object that was not rlocked but wlocked: #17 0xc06b0255 in _rm_runlock_debug (rm=0xc0bce37c, file=<value optimized out>, line=<value optimized out>) at /home/src/sys/kern/kern_rmlock.c:690 690 _rm_assert(rm, RA_RLOCKED, file, line); (kgdb) p rm $1 = (struct rmlock *) 0xc0bce37c (kgdb) p *rm $2 = {lock_object = {lo_name = 0xc0a802a2 "IPFW static rules", lo_flags = 50528256, lo_data = 0, lo_witness = 0xc50c6a20}, rm_writecpus = { __bits = 0xc0bce38c}, rm_activeReaders = {lh_first = 0x0}, _rm_lock = {_rm_wlock_object = {lo_name = 0xc0a802a2 "IPFW static rules", lo_flags = 16842752, lo_data = 0, lo_witness = 0x0}, _rm_lock_mtx = {lock_object = {lo_name = 0xc0a802a2 "IPFW static rules", lo_flags = 16842752, lo_data = 0, lo_witness = 0x0}, mtx_lock = 4}, _rm_lock_sx = {lock_object = {lo_name = 0xc0a802a2 "IPFW static rules", lo_flags = 16842752, lo_data = 0, lo_witness = 0x0}, sx_lock = 4}}} Full kgdb script here: http://www.grosbein.net/freebsd/crash/20170114/kgdb.log There are vmcore, kernel.debug and crashinfo available in the same directory. Is it ipfw bug of assertion bug?