The problem is that you are freeing the ax25 control block too soon for the case of sockets that were never bound. If the socket is not bound, it never makes it into the node list and the refcount is
This is the same patch as earlier today with the bug Stephen mentioned in ax25_cb_del patched. It is made against 2.6.0-test3 Jeroen Attachment: linux-2.6.0-test3.rxq4.diff Description: Binary data