When becoming the master, CARP calls into arprequest/ether_output at
splsoftclock().  All other callers into this path seem to run at
splsoftnet(); the attached patch enforces splsoftnet before these calls.

Chris Pascoe 2004/11/16

Index: netinet/ip_carp.c
===================================================================
RCS file: /cvs/src/sys/netinet/ip_carp.c,v
retrieving revision 1.68
diff -u -r1.68 ip_carp.c
--- netinet/ip_carp.c	28 Oct 2004 20:34:20 -0000	1.68
+++ netinet/ip_carp.c	16 Nov 2004 11:04:53 -0000
@@ -984,7 +984,8 @@
 {
 	struct ifaddr *ifa;
 	in_addr_t in;
-
+	int s = splsoftnet();
+	
 	TAILQ_FOREACH(ifa, &sc->sc_ac.ac_if.if_addrlist, ifa_list) {
 
 		if (ifa->ifa_addr->sa_family != AF_INET)
@@ -994,6 +995,7 @@
 		arprequest(sc->sc_ifp, &in, &in, sc->sc_ac.ac_enaddr);
 		DELAY(1000);	/* XXX */
 	}
+	splx(s);
 }
 
 #ifdef INET6
@@ -1003,6 +1005,7 @@
 	struct ifaddr *ifa;
 	struct in6_addr *in6;
 	static struct in6_addr mcast = IN6ADDR_LINKLOCAL_ALLNODES_INIT;
+	int s = splsoftnet();
 
 	TAILQ_FOREACH(ifa, &sc->sc_ac.ac_if.if_addrlist, ifa_list) {
 
@@ -1014,6 +1017,7 @@
 		    ND_NA_FLAG_OVERRIDE, 1, NULL);
 		DELAY(1000);	/* XXX */
 	}
+	splx(s);
 }
 #endif /* INET6 */