Panic: Memory modified after free

Just received the following panic.  I was using openvpn at the time of
the panic.  If I look at core.txt.2, I see


Tue Jul 21 20:51:38 PDT 2026
Jul 22 08:47:37 hotrats su[4849]: kargl to root on /dev/pts/3
ovpn0: changing name to 'tun0'
tun0: link state changed to UP
Jul 22 08:48:45 hotrats openvpn[4908]: event_wait : Interrupted system 
call (fd=-1,code=4)
ovpn0: changing name to 'tun0'
tun0: link state changed to UP
Jul 22 09:27:42 hotrats openvpn[5673]: event_wait : Interrupted system 
call (fd=-1,code=4)
panic: Memory modified after free 0xfffff8037d3a3300 (256, mbuf) + 8 = 
deadc0dedead40ce

cpuid = 7
time = 1784737711
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 
0xfffffe01498028f0
vpanic() at vpanic+0x136/frame 0xfffffe0149802a20
panic() at panic+0x43/frame 0xfffffe0149802a80
trash_ctor() at trash_ctor+0x74/frame 0xfffffe0149802a90
item_ctor() at item_ctor+0x59/frame 0xfffffe0149802ae0
mc_get() at mc_get+0x14c/frame 0xfffffe0149802b40
mc_uiotomc() at mc_uiotomc+0x8d/frame 0xfffffe0149802b80
uipc_sosend_stream_or_seqpacket() at 
uipc_sosend_stream_or_seqpacket+0x13e/frame 0xfffffe0149802c60
sousrsend() at sousrsend+0x79/frame 0xfffffe0149802cc0
kern_sendit() at kern_sendit+0x1be/frame 0xfffffe0149802d50
sendit() at sendit+0x1ab/frame 0xfffffe0149802da0
sys_sendmsg() at sys_sendmsg+0x5b/frame 0xfffffe0149802e00
amd64_syscall() at amd64_syscall+0x169/frame 0xfffffe0149802f30
fast_syscall_common() at fast_syscall_common+0xf8/frame 0xfffffe0149802f30
--- syscall (28, FreeBSD ELF64, sendmsg), rip = 0x39727abfe3ca, rsp = 
0x397275edc298, rbp = 0x397275edc2c0 ---
KDB: enter: panic

I have crash dump and can upload to kargl@freefall if needed.

-- 
steve