pf_src_tree_remove_state() is called upon pf_insert_state() failures. but pf_insert_state does fiddle with the state's state_key pointer - it has too -, and can leave it at NULL. pf_src_tree_remove_state() tried to grab the protocol from it. fortunately that is superfluous here, since tcp_est will never be set in the non-tcp case - it is only touched in pf_src_connlimit which in turn is only ever called from pf_test_tcp(). ok mcbride + identical diff from pascoe, but he was a few minutes late :)
pf_src_tree_remove_state() is called upon pf_insert_state() failures.
but pf_insert_state does fiddle with the state's state_key pointer - it
has too -, and can leave it at NULL. pf_src_tree_remove_state()
tried to grab the protocol from it. fortunately that is superfluous here,
since tcp_est will never be set in the non-tcp case - it is only touched
in pf_src_connlimit which in turn is only ever called from pf_test_tcp().
ok mcbride + identical diff from pascoe, but he was a few minutes late :)

orumin/openbsd-efivars,orumin/openbsd-efivars,orumin/openbsd-efivars,orumin/openbsd-efivars