[9.2-dev] ospfd crash with signal SIGABRT for 'mpls ldp-sync' and 'fast-reroute ti-lfa' commands

[EasyNetDev]

---

Describe the bug

OSPFD is crashing with SIGABRT after is loading the configuration fie and starts the neighbors.

• Did you check if this is a duplicate issue?
• Did you test it on the latest FRRouting/frr master branch?

To Reproduce

1. Having 2 OSPF in default in one VRF
2. vtysh -d ospfd -f /etc/frr/frr.conf
3. After about 10-15 seconds daemon is crashing

core_handler: showing active allocations in memory group libfrr
core_handler: memstats:  BFD info                      :      2 *        280
core_handler: memstats:  Buffer                        :      6 *         24
core_handler: memstats:  Host config                   :      8 * (variably sized)
core_handler: memstats:  Command Tokens                :   4647 *         72
core_handler: memstats:  Command Token Text            :   3282 * (variably sized)
core_handler: memstats:  Command Token Help            :   3282 * (variably sized)
core_handler: memstats:  Command Argument Name         :    875 * (variably sized)
core_handler: memstats:  Graph                         :     22 *          8
core_handler: memstats:  Graph Node                    :   5423 *         32
core_handler: memstats:  Hash                          :     94 * (variably sized)
core_handler: memstats:  Hash Bucket                   :   1409 *         24
core_handler: memstats:  Hash Index                    :     47 * (variably sized)
core_handler: memstats:  Interface                     :     96 *        280
core_handler: memstats:  Intf Desc                     :     50 * (variably sized)
core_handler: memstats:  Connected                     :    101 *         64
core_handler: memstats:  LDP SYNC info                 :     24 *         24
core_handler: memstats:  Link List                     :    459 *         40
core_handler: memstats:  Link Node                     :    755 *         24
core_handler: memstats:  Temporary memory              :    228 * (variably sized)
core_handler: memstats:  Northbound Node               :    141 *       1200
core_handler: memstats:  Northbound Configuration      :      2 *         16
core_handler: memstats:  Northbound Configuration Entry:    460 *       1032
core_handler: memstats:  Prefix List                   :     32 *         88
core_handler: memstats:  Prefix List Str               :     32 * (variably sized)
core_handler: memstats:  Prefix List Entry             :     61 *        136
core_handler: memstats:  Prefix List Trie Table        :     67 *       4096
core_handler: memstats:  Prefix                        :    101 *         56
core_handler: memstats:  Privilege information         :      3 * (variably sized)
core_handler: memstats:  Route map                     :     32 *        120
core_handler: memstats:  Route map name                :     84 * (variably sized)
core_handler: memstats:  Route map index               :    185 *        152
core_handler: memstats:  Route map rule                :     43 *         40
core_handler: memstats:  Route map rule str            :     43 * (variably sized)
core_handler: memstats:  Route map compiled            :     43 * (variably sized)
core_handler: memstats:  Route map dependency          :      9 *         24
core_handler: memstats:  Route map dependency data     :     43 *         16
core_handler: memstats:  Stream                        :     10 * (variably sized)
core_handler: memstats:  Route table                   :    504 *         56
core_handler: memstats:  Route node                    :    308 *        120
core_handler: memstats:  Thread                        :     29 *        160
core_handler: memstats:  Thread master                 :      4 * (variably sized)
core_handler: memstats:  Thread Poll Info              :      2 *       8192
core_handler: memstats:  Thread stats                  :     25 *        112
core_handler: memstats:  Typed-hash bucket             :     87 * (variably sized)
core_handler: memstats:  Typed-heap array              :      1 *        576
core_handler: memstats:  Vector                        :  10891 *         24
core_handler: memstats:  Vector index                  :  10891 * (variably sized)
core_handler: memstats:  VRF                           :     13 *        216
core_handler: memstats:  VRF bit-map                   :      6 *          8
core_handler: memstats:  VTY                           :      4 * (variably sized)
core_handler: memstats:  VTY server                    :      2 *         32
core_handler: memstats:  YANG module                   :      5 *         48
core_handler: memstats:  Zclient                       :      2 *       3344
core_handler: memstats:  Redistribution instance IDs   :      3 *          2
core_handler: memstats:  log thread-local buffer       :      1 *      24608
core_handler: showing active allocations in memory group Native message allocations
core_handler: showing active allocations in memory group logging subsystem
core_handler: memstats:  syslog target                 :      1 *         56
core_handler: showing active allocations in memory group ospfd
core_handler: memstats:  BFD configuration data        :      5 *         76
core_handler: memstats:  OSPF top                      :      4 * (variably sized)
core_handler: memstats:  OSPF area                     :      2 *        328
core_handler: memstats:  OSPF interface                :      3 *        336
core_handler: memstats:  OSPF neighbor                 :      5 *       1520
core_handler: memstats:  OSPF route                    :     17 *         64
core_handler: memstats:  OSPF LSA                      :      4 *        128
core_handler: memstats:  OSPF LSA data                 :      4 * (variably sized)
core_handler: memstats:  OSPF LSDB                     :      4 *        408
core_handler: memstats:  OSPF packet                   :      4 *         24
core_handler: memstats:  OSPF FIFO queue               :      3 *         24
core_handler: memstats:  OSPF vertex                   :      8 * (variably sized)
core_handler: memstats:  OSPF vertex parent            :      4 *         32
core_handler: memstats:  OSPF nexthop                  :     10 *          8
core_handler: memstats:  OSPF path                     :     17 *         48
core_handler: memstats:  OSPF ext. info                :      1 *         88
core_handler: memstats:  OSPF if info                  :     96 *         40
core_handler: memstats:  OSPF if params                :     96 *        144
core_handler: memstats:  OSPF MPLS parameters          :     96 *        248
core_handler: memstats:  OSPF Extended parameters      :     96 *        136
core_handler: memstats:  OSPF TI-LFA P-Space           :      3 * (variably sized)
core_handler: memstats:  OSPF TI-LFA Q-Space           :      4 * (variably sized)
core_handler: memstats:  OSPF opaque function table    :      6 *        104
core_handler: memstats:  OSPF External route table     :      1 *         16
core_handler: memstats:  OSPF Redistriute              :      1 *         32
Aborted (core dumped)
```

**Expected behavior**
<!--
Write here a clear and concise description of what you expected to happen when
using the reproduction steps you provided above
-->
Not crashing.

**Screenshots**
<!--
If applicable, add screenshots to help explain your problem.
-->

**Versions**
<!--
Include your operating system type and version here

FAILURE TO PROVIDE THIS MAY RESULT IN YOUR ISSUE BEING IGNORED
-->
<!-- e.g. Fedora 24, Debian 10] -->
 - OS Version: Debian 13 Trixie
<!-- [e.g. Linux 5.4, OpenBSD 6.6] -->
 - Kernel: 6.5.13
<!-- e.g. 6.0, 7.4 -->
 - FRR Version: 9.2 git 3a6c3129ddda3509a9718f1a64341043dc3884ae and patched with PR #15286

**Additional context**
<!--
Add any other context about the problem here.
-->
I have the coredump. gdb on coredump reveals:
```
# gdb /usr/lib/frr/ospfd -c /opt/coredump/core-ospfd-6-104-110-620779-1707147306
GNU gdb (Debian 13.2-1) 13.2
Copyright (C) 2023 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Type "show copying" and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<https://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
    <http://www.gnu.org/software/gdb/documentation/>.

For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from /usr/lib/frr/ospfd...
Reading symbols from /usr/lib/debug/.build-id/ff/66b6f4dcb4113365ec9b52528a3c59f78ac325.debug...
[New LWP 620779]
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
Core was generated by `/usr/lib/frr/ospfd -u frr -F traditional -A 127.0.0.1'.
Program terminated with signal SIGABRT, Aborted.
#0  __pthread_kill_implementation (threadid=<optimized out>, signo=signo@entry=6, no_tid=no_tid@entry=0)
    at ./nptl/pthread_kill.c:44
44      ./nptl/pthread_kill.c: No such file or directory.
(gdb) bt
#0  __pthread_kill_implementation (threadid=<optimized out>, signo=signo@entry=6, no_tid=no_tid@entry=0)
    at ./nptl/pthread_kill.c:44
#1  0x00007f951d0a815f in __pthread_kill_internal (signo=6, threadid=<optimized out>) at ./nptl/pthread_kill.c:78
#2  0x00007f951d05a472 in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26
#3  0x00007f951d2fe040 in core_handler (signo=6, siginfo=0x7ffe2314d670, context=<optimized out>) at ../lib/sigevent.c:248
#4  <signal handler called>
#5  __pthread_kill_implementation (threadid=<optimized out>, signo=signo@entry=6, no_tid=no_tid@entry=0)
    at ./nptl/pthread_kill.c:44
#6  0x00007f951d0a815f in __pthread_kill_internal (signo=6, threadid=<optimized out>) at ./nptl/pthread_kill.c:78
#7  0x00007f951d05a472 in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26
#8  0x00007f951d0444b2 in __GI_abort () at ./stdlib/abort.c:79
#9  0x00007f951d32f89d in _zlog_assert_failed (xref=xref@entry=0x56296d94ba80 <_xref.32>, extra=extra@entry=0x0)
    at ../lib/zlog.c:670
#10 0x000056296d89885e in ospf_ti_lfa_find_q_node (q_space=<optimized out>, p_space=<optimized out>, pc_node=0x56296fae1900)
    at ../ospfd/ospf_ti_lfa.c:111
#11 ospf_ti_lfa_generate_label_stack (q_space=0x56296fadedb0, p_space=0x56296fae1840, area=0x56296f9dd000)
    at ../ospfd/ospf_ti_lfa.c:401
#12 ospf_ti_lfa_generate_q_spaces (area=area@entry=0x56296f9dd000, p_space=p_space@entry=0x56296fae1840,
    dest=dest@entry=0x56296fae3240, recursive=recursive@entry=true, pc_path=pc_path@entry=0x0) at ../ospfd/ospf_ti_lfa.c:713
#13 0x000056296d8995bb in ospf_ti_lfa_generate_p_space (area=area@entry=0x56296f9dd000, child=child@entry=0x56296fae3240,
    protected_resource=<optimized out>, recursive=recursive@entry=true, pc_path=pc_path@entry=0x0)
    at ../ospfd/ospf_ti_lfa.c:812
#14 0x000056296d89985c in ospf_ti_lfa_generate_p_spaces (area=area@entry=0x56296f9dd000, protection_type=<optimized out>)
    at ../ospfd/ospf_ti_lfa.c:923
#15 0x000056296d899938 in ospf_ti_lfa_compute (area=area@entry=0x56296f9dd000, new_table=new_table@entry=0x56296f9ef290,
    protection_type=<optimized out>) at ../ospfd/ospf_ti_lfa.c:1101
#16 0x000056296d896f32 in ospf_spf_calculate_area (ospf=ospf@entry=0x56296f9db770, area=0x56296f9dd000,
    new_table=new_table@entry=0x56296f9ef290, all_rtrs=all_rtrs@entry=0x0, new_rtrs=new_rtrs@entry=0x56296f9ef320)
    at ../ospfd/ospf_spf.c:1811
#17 0x000056296d896fe8 in ospf_spf_calculate_areas (ospf=ospf@entry=0x56296f9db770, new_table=new_table@entry=0x56296f9ef290,
    all_rtrs=all_rtrs@entry=0x0, new_rtrs=new_rtrs@entry=0x56296f9ef320) at ../ospfd/ospf_spf.c:1840
#18 0x000056296d8970c0 in ospf_spf_calculate_schedule_worker (thread=<optimized out>) at ../ospfd/ospf_spf.c:1871
--Type <RET> for more, q to quit, c to continue without paging--
#19 0x00007f951d310cf5 in event_call (thread=thread@entry=0x7ffe2314e5f0) at ../lib/event.c:2008
#20 0x00007f951d2bb318 in frr_run (master=0x56296f5f8ee0) at ../lib/libfrr.c:1214
#21 0x000056296d86c298 in main (argc=7, argv=0x7ffe2314e838) at ../ospfd/ospf_main.c:289
```

[EasyNetDev]

Looks like mpls ldp-sync command on router ospf is causing the crash.

router ospf
 ospf router-id 10.100.2.1
 log-adjacency-changes
 compatible rfc1583
 maximum-paths 4
 flood-reduction
 fast-reroute ti-lfa
 area 10 stub no-summary
exit

As soon I'm adding mpls ldp-sync under router ospf the daemon is crashing.

Doing some extensive tests I've notice that combination of fast-reroute ti-lfa with mpls ldp-sync is causing the daemon to crash. If there is only one command active under OSPF, everything is working fine.

[donaldsharp]

I cannot make this happen. Can you provide the actual topology + config that you are seeing this issue?

[EasyNetDev]

Sure:
R01:
daemons:

# cat /etc/frr/daemons
# This file tells the frr package which daemons to start.
#
# Sample configurations for these daemons can be found in
# /usr/share/doc/frr/examples/.
#
# ATTENTION:
#
# When activating a daemon for the first time, a config file, even if it is
# empty, has to be present *and* be owned by the user and group "frr", else
# the daemon will not be started by /etc/init.d/frr. The permissions should
# be u=rw,g=r,o=.
# When using "vtysh" such a config file is also needed. It should be owned by
# group "frrvty" and set to ug=rw,o= though. Check /etc/pam.d/frr, too.
#
# The watchfrr, zebra and staticd daemons are always started.
#
bgpd=yes
ospfd=yes
#ospfd_instances=1,2,3,4
ospf6d=yes
ripd=no
ripngd=no
isisd=yes
pimd=yes
pim6d=yes
ldpd=yes
nhrpd=yes
eigrpd=yes
babeld=no
sharpd=no
pbrd=yes
bfdd=yes
fabricd=no
vrrpd=yes
pathd=yes

#
# If this option is set the /etc/init.d/frr script automatically loads
# the config via "vtysh -b" when the servers are started.
# Check /etc/pam.d/frr if you intend to use "vtysh"!
#
vtysh_enable=yes
zebra_options="  -A 127.0.0.1 -s 90000000 -M snmp"
bgpd_options="   -A 127.0.0.1 -M rpki -M snmp"
ospfd_options="  -A 127.0.0.1 -M snmp"
ospf6d_options=" -A ::1 -M snmp"
ripd_options="   -A 127.0.0.1 -M snmp"
ripngd_options=" -A ::1"
isisd_options="  -A 127.0.0.1 -M snmp"
pimd_options="   -A 127.0.0.1"
pim6d_options="  -A ::1"
ldpd_options="   -A 127.0.0.1 -M snmp"
nhrpd_options="  -A 127.0.0.1"
eigrpd_options=" -A 127.0.0.1"
babeld_options=" -A 127.0.0.1"
sharpd_options=" -A 127.0.0.1"
pbrd_options="   -A 127.0.0.1"
staticd_options="-A 127.0.0.1"
bfdd_options="   -A 127.0.0.1"
fabricd_options="-A 127.0.0.1"
vrrpd_options="  -A 127.0.0.1"
pathd_options="  -A 127.0.0.1"


# If you want to pass a common option to all daemons, you can use the
# "frr_global_options" variable.
#
#frr_global_options=""


# The list of daemons to watch is automatically generated by the init script.
# This variable can be used to pass options to watchfrr that will be passed
# prior to the daemon list.
#
# To make watchfrr create/join the specified netns, add the the "--netns"
# option here. It will only have an effect in /etc/frr/<somename>/daemons, and
# you need to start FRR with "/usr/lib/frr/frrinit.sh start <somename>".
#
#watchfrr_options=""


# configuration profile
#
#frr_profile="traditional"
#frr_profile="datacenter"


# This is the maximum number of FD's that will be available.  Upon startup this
# is read by the control files and ulimit is called.  Uncomment and use a
# reasonable value for your setup if you are expecting a large number of peers
# in say BGP.
#
#MAX_FDS=1024

# Uncomment this option if you want to run FRR as a non-root user. Note that
# you should know what you are doing since most of the daemons need root
# to work. This could be useful if you want to run FRR in a container
# for instance.
# FRR_NO_ROOT="yes"

# For any daemon, you can specify a "wrap" command to start instead of starting
# the daemon directly. This will simply be prepended to the daemon invocation.
# These variables have the form daemon_wrap, where 'daemon' is the name of the
# daemon (the same pattern as the daemon_options variables).
#
# Note that when daemons are started, they are told to daemonize with the `-d`
# option. This has several implications. For one, the init script expects that
# when it invokes a daemon, the invocation returns immediately. If you add a
# wrap command here, it must comply with this expectation and daemonize as
# well, or the init script will never return. Furthermore, because daemons are
# themselves daemonized with -d, you must ensure that your wrapper command is
# capable of following child processes after a fork() if you need it to do so.
#
# If your desired wrapper does not support daemonization, you can wrap it with
# a utility program that daemonizes programs, such as 'daemonize'. An example
# of this might look like:
#
# bgpd_wrap="/usr/bin/daemonize /usr/bin/mywrapper"
#
# This is particularly useful for programs which record processes but lack
# daemonization options, such as perf and rr.
#
# If you wish to wrap all daemons in the same way, you may set the "all_wrap"
# variable.
#
#all_wrap=""

Config:

R02:

frr version 9.2-dev
frr defaults traditional
hostname R02
log syslog
log facility syslog
log timestamp precision 4
agentx
service integrated-vtysh-config

interface lan0.3001
 description R01 / MPLS-02
 ip ospf area 0
 ip ospf bfd
 ip ospf network point-to-point
exit
!
interface lo
 description Loopback MPLS / BGP VPNv4 + VPNv6
 ip ospf area 0
 ip ospf passive
exit
!
interface wan0.3000
 description R01 / MPLS-01
 ip ospf area 0
 ip ospf bfd
 ip ospf network point-to-point
exit
!
interface lan0.4091
 description IPTV MC Routing
 ip ospf area 0
 ip ospf bfd
exit
!
router ospf
 ospf router-id 10.100.2.1
 log-adjacency-changes
 compatible rfc1583
 maximum-paths 4
 flood-reduction
 area 10 stub no-summary
 mpls ldp-sync
exit
!
router ospf vrf iptv
 ospf router-id 10.100.2.1
 log-adjacency-changes
 compatible rfc1583
 maximum-paths 4
 default-information originate always
exit

R02# show interface lo
Interface lo is up, line protocol detection is disabled
  Link ups:       0    last: (never)
  Link downs:     0    last: (never)
  vrf: default
  Description: Loopback MPLS / BGP VPNv4 + VPNv6
  index 1 metric 0 mtu 65536 speed 0 txqlen 1000
  flags: <UP,LOOPBACK,RUNNING>
  MPLS enabled
  Ignore all v6 routes with linkdown
  Type: Loopback
  inet 10.100.2.1/32
  inet6 fc00:0:0:2::1/128
  Interface Type Other
  Interface Slave Type None
  protodown: off

R02# show interface lan0.3001
Interface lan0.3001 is up, line protocol is up
  Link ups:      18    last: 2024/02/06 22:03:23.33
  Link downs:     0    last: (never)
  vrf: default
  Description: R01 / MPLS-02
  index 57 metric 0 mtu 9216 speed 80000 txqlen 1000
  flags: <UP,BROADCAST,RUNNING,MULTICAST>
  MPLS enabled
  Ignore all v4 routes with linkdown
  Ignore all v6 routes with linkdown
  Type: Ethernet
  HWaddr: ce:2c:11:6d:2a:4d
  inet 10.100.0.6/30
  inet6 fc00:10:100::6/126
  inet6 fe80::cc2c:11ff:fe6d:2a4d/64
  Interface Type Vlan
  Interface Slave Type None
  VLAN Id 3001
  protodown: off
  Parent interface: lan0
  ND advertised reachable time is 0 milliseconds
  ND advertised retransmit interval is 0 milliseconds
  ND advertised hop-count limit is 64 hops
  ND router advertisements sent: 24137 rcvd: 14434
  ND router advertisements are sent every 10 seconds
  ND router advertisements lifetime tracks ra-interval
  ND router advertisement default router preference is medium
  Hosts use stateless autoconfig for addresses.
  Neighbor address(s):
  inet6 fe80::7410:45ff:fef5:319b/128

R02# show interface wan0.3000
Interface wan0.3000 is up, line protocol is up
  Link ups:      32    last: 2024/02/06 22:03:42.29
  Link downs:     0    last: (never)
  vrf: default
  Description: R01 / MPLS-01
  index 56 metric 0 mtu 9216 speed 80000 txqlen 1000
  flags: <UP,BROADCAST,RUNNING,MULTICAST>
  MPLS enabled
  Ignore all v4 routes with linkdown
  Ignore all v6 routes with linkdown
  v6 Multicast forwarding is on
  Type: Ethernet
  HWaddr: 2a:4e:54:b7:aa:69
  inet 10.100.0.2/30
  inet6 fc00:10:100::2/126
  inet6 fe80::284e:54ff:feb7:aa69/64
  Interface Type Vlan
  Interface Slave Type None
  VLAN Id 3000
  protodown: off
  Parent interface: wan0
  ND advertised reachable time is 0 milliseconds
  ND advertised retransmit interval is 0 milliseconds
  ND advertised hop-count limit is 64 hops
  ND router advertisements sent: 24181 rcvd: 24133
  ND router advertisements are sent every 10 seconds
  ND router advertisements lifetime tracks ra-interval
  ND router advertisement default router preference is medium
  Hosts use stateless autoconfig for addresses.
  Neighbor address(s):
  inet6 fe80::5888:9aff:feb7:9fa0/128

R02# show interface lan0.4091
Interface lan0.4091 is up, line protocol is up
  Link ups:       0    last: (never)
  Link downs:     0    last: (never)
  vrf: iptv
  Description: IPTV MC Routing
  index 89 metric 0 mtu 1500 speed 80000 txqlen 1000
  flags: <UP,BROADCAST,RUNNING,MULTICAST>
  Ignore all v4 routes with linkdown
  Ignore all v6 routes with linkdown
  v4 Multicast forwarding is on
  Type: Ethernet
  HWaddr: ce:2c:11:6d:2a:4d
  inet 10.190.129.3/28
  inet6 fe80::cc2c:11ff:fe6d:2a4d/64
  Interface Type Vlan
  Interface Slave Type Vrf
  VLAN Id 4091
  protodown: off
  Parent interface: lan0

R02# show ip ospf interface
lan0.3001 is up
  ifindex 57, MTU 9216 bytes, BW 80000 Mbit <UP,BROADCAST,RUNNING,MULTICAST>
  Internet Address 10.100.0.6/30, Broadcast 10.100.0.7, Area 0.0.0.0
  MTU mismatch detection: enabled
  Router ID 10.100.2.1, Network Type POINTOPOINT, Cost: 65535
  Transmit Delay is 1 sec, State Point-To-Point, Priority 1
  No backup designated router on this network
  Multicast group memberships: OSPFAllRouters
  Timer intervals configured, Hello 10s, Dead 40s, Wait 40s, Retransmit 5
    Hello due in 8.538s
  Neighbor Count is 1, Adjacent neighbor count is 1
  Graceful Restart hello delay: 10s
  BFD: Detect Multiplier: 3, Min Rx interval: 300, Min Tx interval: 300
lo is up
  ifindex 1, MTU 65536 bytes, BW 0 Mbit <UP,LOOPBACK,RUNNING>
  Internet Address 10.100.2.1/32, Broadcast 10.100.2.1, Area 0.0.0.0
  MTU mismatch detection: enabled
  Router ID 10.100.2.1, Network Type LOOPBACK, Cost: 0
  Transmit Delay is 1 sec, State Loopback, Priority 1
  No backup designated router on this network
  Multicast group memberships: <None>
  Timer intervals configured, Hello 10s, Dead 40s, Wait 40s, Retransmit 5
    No Hellos (Passive interface)
  Neighbor Count is 0, Adjacent neighbor count is 0
  Graceful Restart hello delay: 10s
wan0.3000 is up
  ifindex 56, MTU 9216 bytes, BW 80000 Mbit <UP,BROADCAST,RUNNING,MULTICAST>
  Internet Address 10.100.0.2/30, Broadcast 10.100.0.3, Area 0.0.0.0
  MTU mismatch detection: enabled
  Router ID 10.100.2.1, Network Type POINTOPOINT, Cost: 1
  Transmit Delay is 1 sec, State Point-To-Point, Priority 1
  No backup designated router on this network
  Multicast group memberships: OSPFAllRouters
  Timer intervals configured, Hello 10s, Dead 40s, Wait 40s, Retransmit 5
    Hello due in 8.538s
  Neighbor Count is 1, Adjacent neighbor count is 1
  Graceful Restart hello delay: 10s
  BFD: Detect Multiplier: 3, Min Rx interval: 300, Min Tx interval: 300

R02# show ip ospf vrf iptv interface
VRF Name: iptv
lan0.4091 is up
  ifindex 89, MTU 1500 bytes, BW 80000 Mbit <UP,BROADCAST,RUNNING,MULTICAST>
  Internet Address 10.190.129.3/28, Broadcast 10.190.129.15, Area 0.0.0.0
  MTU mismatch detection: enabled
  Router ID 10.100.2.1, Network Type BROADCAST, Cost: 1
  Transmit Delay is 1 sec, State DROther, Priority 1
  Designated Router (ID) 10.190.128.30 Interface Address 10.190.129.4/28
  Backup Designated Router (ID) 10.100.1.1, Interface Address 10.190.129.2
  Multicast group memberships: OSPFAllRouters
  Timer intervals configured, Hello 10s, Dead 40s, Wait 40s, Retransmit 5
    Hello due in 3.214s
  Neighbor Count is 2, Adjacent neighbor count is 2
  Graceful Restart hello delay: 10s
  BFD: Detect Multiplier: 3, Min Rx interval: 300, Min Tx interval: 300

R02# show ip ospf neighbor

Neighbor ID     Pri State           Up Time         Dead Time Address         Interface                        RXm
tL RqstL DBsmL
10.100.1.1        1 Full/-          1d03h30m          36.923s 10.100.0.5      lan0.3001:10.100.0.6
 0     0     0
10.100.1.1        1 Full/-          1d03h30m          36.923s 10.100.0.1      wan0.3000:10.100.0.2
 0     0     0

R02# show ip ospf vrf iptv neighbor
VRF Name: iptv

Neighbor ID     Pri State           Up Time         Dead Time Address         Interface                        RXm
tL RqstL DBsmL
10.100.1.1        1 Full/Backup     1d03h30m          32.450s 10.190.129.2    lan0.4091:10.190.129.3
 0     0     0
10.190.129.4      1 Full/DR         39.888s           34.017s 10.190.129.4    lan0.4091:10.190.129.3
 0     0     0

R02# show running-config ldpd
debug mpls ldp errors
debug mpls ldp event
debug mpls ldp labels
debug mpls ldp messages recv all
debug mpls ldp messages sent all
debug mpls ldp sync
!
mpls ldp
 router-id 10.100.2.1
 dual-stack cisco-interop
 ordered-control
 neighbor 10.100.1.1 ttl-security disable
 neighbor 10.100.1.1 password XXXXXXX
 !
 address-family ipv4
  discovery transport-address 10.100.2.1
  !
 exit-address-family
 !
 address-family ipv6
  discovery transport-address fc00:0:0:2::1
  !
  interface lan0.3001
  exit
  !
  interface wan0.3000
  exit
  !
 exit-address-family
 !
exit

[EasyNetDev]

Hi @donaldsharp,

I retested yesterday the same commands on 9.2-dev commit Commits on Feb 7, 2024 and looks like I can't reproduce it anymore.
Very strange that few releases before Commits on Feb 7, 2024 I had the same issues.

I think we can close the issue for the moment and I will test in next period to see if still crashing or not. In case is still crashing I will reopen the case.