From nobody  Mon May 25 18:46:57 1998
Received: (from nobody@localhost)
          by hub.freebsd.org (8.8.8/8.8.8) id SAA22065;
          Mon, 25 May 1998 18:46:57 -0700 (PDT)
          (envelope-from nobody)
Message-Id: <199805260146.SAA22065@hub.freebsd.org>
Date: Mon, 25 May 1998 18:46:57 -0700 (PDT)
From: sepotvin@videotron.ca
To: freebsd-gnats-submit@freebsd.org
Subject: if_zp do not probe the MAC address properly
X-Send-Pr-Version: www-1.0

>Number:         6757
>Category:       kern
>Synopsis:       if_zp do not probe the MAC address properly
>Confidential:   no
>Severity:       serious
>Priority:       high
>Responsible:    freebsd-bugs
>State:          closed
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Mon May 25 18:50:01 PDT 1998
>Closed-Date:    Mon May 25 19:28:56 PDT 1998
>Last-Modified:  Mon May 25 19:30:50 PDT 1998
>Originator:     Stephane E. Potvin
>Release:        FreeBSD 3.0-980521-SNAP
>Organization:
IBM Canada Ltd.
>Environment:
FreeBSD azimov.videotron.ca 3.0-980521-SNAP FreeBSD 3.0-980521-SNAP #0: Sun May 24 14:12:46 EDT 1998     rubik@azimov.videotron.ca:/usr/local/src/sys/compile/AZIMOV  i386
>Description:
The driver uses a wrong index variable to store the value of the MAC
address that was read from the card. The value read is written to a
semi-random place in the kernel causing the system to crash a few
seconds after booting.
>How-To-Repeat:
Boot a current kernel with a 3COM EtherLink III PCMCIA card inserted.
>Fix:
*** if_zp.c.orig        Sat Mar 28 08:24:28 1998
--- if_zp.c     Mon May 25 21:39:16 1998
***************
*** 542,548 ****
                short   tmp_addr[3];
                int     j;
                for (j = 0; j < 3; j++) {
!                       tmp_addr[i] = htons(read_eeprom_data(BASE, j));
                }
                bcopy(tmp_addr, sc->arpcom.ac_enaddr, 6);
        }
--- 542,548 ----
                short   tmp_addr[3];
                int     j;
                for (j = 0; j < 3; j++) {
!                       tmp_addr[j] = htons(read_eeprom_data(BASE, j));
                }
                bcopy(tmp_addr, sc->arpcom.ac_enaddr, 6);
        }

>Release-Note:
>Audit-Trail:
State-Changed-From-To: open->closed 
State-Changed-By: jmb 
State-Changed-When: Mon May 25 19:28:56 PDT 1998 
State-Changed-Why:  
diff submitted with PR has been committed to the tree. 
>Unformatted:
