Kernel panic (page fault) when AX88179A USB Ethernet adapter disconnects during netlink interface poll

Important notices

Before you add a new report, we ask you kindly to acknowledge the following:

• [X ] I have read the contributing guidelines at https://github.com/opnsense/core/blob/master/CONTRIBUTING.md
• [X ] I am convinced that my issue is new after having checked both open and closed issues at https://github.com/opnsense/core/issues?q=is%3Aissue

Describe the bug

Kernel panic (fatal trap 12: page fault) occurs when the FreeBSD
netlink subsystem polls interface status while an AX88179A USB
Ethernet adapter simultaneously disconnects or flaps.

The race condition occurs between rtnl_handle_getlink() iterating
all interfaces and axge_miibus_readreg() attempting a USB request
to an adapter that has already been detached, causing a
use-after-free at __mtx_lock_sleep().

Additionally, physically unplugging the AX88179A adapter while
OPNsense is running consistently triggers an immediate kernel panic
and automatic reboot, making it impossible to safely remove the
adapter during operation.

The adapter continuously flaps (link UP/DOWN cycling) from boot,
eventually triggering the panic when netlink polls coincide with
a disconnect event.

Last known working state: unknown — issue appeared after updating
from OPNsense 26.1 to 26.1.6 and installing os-ddclient.

To Reproduce

1. Attach an ASIX AX88179A USB Ethernet adapter (plugable model: USB3-E1000) to OPNsense
2. Assign it as a network interface (WAN or LAN) via
   Interfaces → Assignments
3. Allow system to boot fully and observe ue0 link flapping
   repeatedly in dmesg (UP/DOWN cycling every 1-2 seconds)
4. Either:
   a) Wait for netlink poll to coincide with adapter disconnect, OR
   b) Physically unplug the USB adapter while system is running
5. System immediately panics and reboots

Panic is 100% reproducible by physically unplugging the adapter.

Expected behavior
Physically unplugging a USB Ethernet adapter should gracefully
detach the interface without causing a kernel panic. The netlink
subsystem should safely handle interface detachment during
status polling without accessing freed memory.

Describe alternatives you considered

• Attempted ifconfig ue0 down before unplugging — does not prevent
  the panic
• Swapped interface roles (WAN/LAN) — does not resolve the flapping
  or panic
• Rebooting the system — panic recurs whenever adapter is unplugged
• The crash report GUI in OPNsense could not submit automatically
  due to no internet connectivity on the firewall during testing

Screenshots

If applicable, add screenshots to help explain your problem.

Relevant log files

Panic string: page fault

Backtrace:
kdb_enter()
panic()
trap_pfault()
calltrap()
__mtx_lock_sleep() at __mtx_lock_sleep+0xc9
usbd_do_request_flags() at usbd_do_request_flags+0x8a8
usbd_do_request_proc() at usbd_do_request_proc+0x5e
axge_miibus_readreg() at axge_miibus_readreg+0x94
ukphy_status() at ukphy_status+0x243
ukphy_service() at ukphy_service+0x37
mii_pollstat() at mii_pollstat+0x57
axge_ifmedia_sts() at axge_ifmedia_sts+0x48
ifmedia_ioctl() at ifmedia_ioctl+0x176
dump_iface() at dump_iface+0x145
dump_cb() at dump_cb+0x1c
if_foreach_sleep() at if_foreach_sleep+0x227
rtnl_handle_getlink() at rtnl_handle_getlink+0x24d
rtnl_handle_message() at rtnl_handle_message+0x195
nl_taskqueue_handler() at nl_taskqueue_handler+0x7ab
taskqueue_run_locked() at taskqueue_run_locked+0x182
taskqueue_thread_loop() at taskqueue_thread_loop+0xc2
fork_exit()
fork_trampoline()

fault virtual address = 0x458
fault code = supervisor read data, page not present
instruction pointer = 0xffffffff80bbbd09
Panic: page fault

Additional context

The adapter was detected as:
ugen2.3: at usbus2
axge0: <ASIX AX88179A, class 0/0, rev 2.10/2.00, addr 2> on usbus2
ue0: on axge0

dmesg shows continuous flapping from boot second [8] through [55]
when panic occurred:
ue0: link state changed to DOWN
ue0: link state changed to UP
(repeated dozens of times every second)
[55] ugen2.3: at usbus2 (disconnected)
[56] Fatal trap 12: page fault while in kernel mode

Full crash dump and OPNsense bug report file available on request.
Note: This may be a FreeBSD kernel bug also reportable at
https://bugs.freebsd.org — the axge driver does not safely
handle concurrent detachment during MII polling.

Environment
OPNsense 26.1.6 (amd64)
FreeBSD 14.3-RELEASE-p10 stable/26.1-n272047-4ad47b697b0a
Plugins: os-ddclient-1.30_2
OpenSSL 3.0.20
Python 3.13.12
PHP 8.3.30

Hardware:
Lenovo ThinkCentre M715q Tiny
AMD Ryzen 5 2400GE with Radeon Vega Graphics
8GB RAM
256GB NVMe (Patriot M.2 P320)
Built-in NIC: RealTek 8168/8111 PCIe Gigabit (re0)
USB NIC: ASIX AX88179A USB 3.0 Gigabit Ethernet (ue0/axge0)

OPNsense_bug_report.txt

Start with the axge_miibus_readreg() and rtnl_handle_getlink() paths named in the backtrace, then reproduce the failure by polling the interface while unplugging the AX88179A adapter. Use the supplied panic trace and dmesg link-flapping output to verify the investigation; done means detaching or unplugging the adapter no longer causes a kernel page fault or reboot.