From: Tom Smyth <tom.smyth@wirelessconnect.eu>
Subject: Re: Bug Reported by me today Create, Bridge, change bridge timeout and then destroy bridge kernel panic
To: tech <tech@openbsd.org>
Date: Tue, 3 Nov 2026 18:41:16 +0000

Folks I tested the following patch ( with assistance  from ai)
and it stopped the panic on AMD64 on 8.0  on 5 separate runs

Index: sys/net/if_bridge.c
--- sys/net/if_bridge.c.orig
+++ sys/net/if_bridge.c
@@ -231,6 +231,7 @@
  NET_ASSERT_UNLOCKED();

  bridge_stop(sc);
+ timeout_del_barrier(&sc->sc_brtimeout);
  bridge_rtflush(sc, IFBF_FLUSHALL);
  while ((bif = SMR_SLIST_FIRST_LOCKED(&sc->sc_iflist)) != NULL)
  bridge_ifremove(bif);
Index: sys/net/bridgectl.c
--- sys/net/bridgectl.c.orig
+++ sys/net/bridgectl.c
@@ -113,9 +113,11 @@
  break;
  }
  sc->sc_brttimeout = bparam->ifbrp_ctime;
- if (bparam->ifbrp_ctime != 0)
- timeout_add_sec(&sc->sc_brtimeout, sc->sc_brttimeout);
- else
+ if (bparam->ifbrp_ctime != 0) {
+ if (ISSET(ifp->if_flags, IFF_RUNNING))
+ timeout_add_sec(&sc->sc_brtimeout,
+    sc->sc_brttimeout);
+ } else
  timeout_del(&sc->sc_brtimeout);
  break;
  case SIOCBRDGGTO: