In FreeBSD before 11.2-STABLE(r338986) 11.2-RELEASE-p4 11.1-RELEASE-p15 10.4-STABLE(r338985) and 10.4-RELEASE-p13 due to improper maintenance of IPv6 protocol control block flags through various failure paths an unprivileged authenticated local user may be able to cause a NULL pointer dereference causing the kernel to crash.