Hi,

Traversing ifnetlist needs either kernel lock or shared net lock.
I have added some asserts to check that.

ok?

bluhm

Index: net/if.c
===================================================================
RCS file: /data/mirror/openbsd/cvs/src/sys/net/if.c,v
diff -u -p -r1.745 if.c
--- net/if.c	11 Nov 2025 07:56:50 -0000	1.745
+++ net/if.c	11 Nov 2025 14:35:17 -0000
@@ -1389,6 +1389,7 @@ if_clone_destroy(const char *name)
 	if (ifc->ifc_destroy == NULL)
 		return (EOPNOTSUPP);
 
+	KERNEL_ASSERT_LOCKED();
 	rw_enter_write(&if_cloners_lock);
 
 	TAILQ_FOREACH(ifp, &ifnetlist, if_list) {
@@ -2735,6 +2736,8 @@ ifconf(caddr_t data)
 	struct ifaddr *ifa;
 	struct ifreq ifr, *ifrp;
 	int space = ifc->ifc_len, error = 0;
+
+	NET_ASSERT_LOCKED();
 
 	/* If ifc->ifc_len is 0, fill it in with the needed size and return. */
 	if (space == 0) {
Index: netinet/in.c
===================================================================
RCS file: /data/mirror/openbsd/cvs/src/sys/netinet/in.c,v
diff -u -p -r1.187 in.c
--- netinet/in.c	8 Jul 2025 00:47:41 -0000	1.187
+++ netinet/in.c	11 Nov 2025 14:35:17 -0000
@@ -801,6 +801,8 @@ in_broadcast(struct in_addr in, u_int rt
 	struct ifaddr *ifa;
 	u_int rdomain;
 
+	NET_ASSERT_LOCKED();
+
 	rdomain = rtable_l2(rtableid);
 
 #define ia (ifatoia(ifa))
Index: netinet6/in6.c
===================================================================
RCS file: /data/mirror/openbsd/cvs/src/sys/netinet6/in6.c,v
diff -u -p -r1.273 in6.c
--- netinet6/in6.c	16 Sep 2025 09:18:29 -0000	1.273
+++ netinet6/in6.c	11 Nov 2025 14:35:17 -0000
@@ -1336,6 +1336,8 @@ in6_ifawithscope(struct ifnet *oifp, con
 		return (NULL);
 	}
 
+	NET_ASSERT_LOCKED();
+
 	/* We search for all addresses on all interfaces from the beginning. */
 	TAILQ_FOREACH(ifp, &ifnetlist, if_list) {
 		if (ifp->if_rdomain != rdomain)
Index: netinet6/in6_ifattach.c
===================================================================
RCS file: /data/mirror/openbsd/cvs/src/sys/netinet6/in6_ifattach.c,v
diff -u -p -r1.124 in6_ifattach.c
--- netinet6/in6_ifattach.c	8 Jul 2025 00:47:41 -0000	1.124
+++ netinet6/in6_ifattach.c	11 Nov 2025 14:35:17 -0000
@@ -199,6 +199,8 @@ in6_get_ifid(struct ifnet *ifp0, struct 
 	if (in6_get_hw_ifid(ifp0, in6) == 0)
 		return;
 
+	NET_ASSERT_LOCKED();
+
 	/* next, try to get it from some other hardware interface */
 	TAILQ_FOREACH(ifp, &ifnetlist, if_list) {
 		if (ifp == ifp0)
Index: netinet6/ip6_mroute.c
===================================================================
RCS file: /data/mirror/openbsd/cvs/src/sys/netinet6/ip6_mroute.c,v
diff -u -p -r1.155 ip6_mroute.c
--- netinet6/ip6_mroute.c	16 Sep 2025 09:18:55 -0000	1.155
+++ netinet6/ip6_mroute.c	11 Nov 2025 14:35:17 -0000
@@ -1232,6 +1232,8 @@ mrt6_iflookupbymif(mifi_t mifi, unsigned
 	struct mif6	*m6;
 	struct ifnet	*ifp;
 
+	NET_ASSERT_LOCKED();
+
 	TAILQ_FOREACH(ifp, &ifnetlist, if_list) {
 		if (ifp->if_rdomain != rtableid)
 			continue;