untrusted comment: signature from openbsd 5.9 base secret key
RWQJVNompF3pwQLgacD5PJSK7bVm558XCGoA41bS61EIAmrDw42bFgDX+ZmFpuxMlrgZKhfw3X/05TEALD/s7jzt358nnTfgYgs=

OpenBSD 5.9 errata 004, Apr 30, 2016:

A problem in m_dup_pkt() can result in kernel crashes with carp(4).

Apply by doing:
   signify -Vep /etc/signify/openbsd-59-base.pub -x 004_mbuf.patch.sig \
       -m - | (cd /usr/src && patch -p0)

And then rebuild and install a kernel:
   cd /usr/src/sys/arch/`machine`/conf
   KK=`sysctl -n kern.osversion | cut -d# -f1`
   config $KK
   cd ../compile/$KK
   make
   make install

Index: sys/kern/uipc_mbuf.c
===================================================================
RCS file: /cvs/src/sys/kern/uipc_mbuf.c,v
diff -u -p -r1.219 -r1.219.2.1
--- sys/kern/uipc_mbuf.c        23 Feb 2016 01:39:14 -0000      1.219
+++ sys/kern/uipc_mbuf.c        28 Apr 2016 22:31:55 -0000      1.219.2.1
@@ -1223,7 +1223,7 @@ m_dup_pkt(struct mbuf *m0, unsigned int
       if (len > MAXMCLBYTES) /* XXX */
               return (NULL);

-       m = m_get(m0->m_type, wait);
+       m = m_get(wait, m0->m_type);
       if (m == NULL)
               return (NULL);

@@ -1231,7 +1231,7 @@ m_dup_pkt(struct mbuf *m0, unsigned int
               goto fail;

       if (len > MHLEN) {
-               MCLGETI(m, len, NULL, wait);
+               MCLGETI(m, wait, NULL, len);
               if (!ISSET(m->m_flags, M_EXT))
                       goto fail;
       }