If a kif is created for an interface group from a pf.conf file then we end up with two entries for the same pfi_kif in the pfi_ifs structure - one for the group and one for an interface with the same name. This wreaks havoc later on when you do something like change rulesets. The changes here seem obvious - don't create an interface pfi_kif if we just created a dynamic group kif with the same name. Chris Pascoe 2004/08/07 Index: pf_if.c =================================================================== RCS file: /cvs/src/sys/net/pf_if.c,v retrieving revision 1.17 diff -u -r1.17 pf_if.c --- pf_if.c 11 Jul 2004 15:22:22 -0000 1.17 +++ pf_if.c 7 Aug 2004 10:29:44 -0000 @@ -225,8 +225,8 @@ pfi_newgroup(key.pfik_name, PFI_IFLAG_DYNAMIC); q = pfi_lookup_if(key.pfik_name); } - q = pfi_lookup_if(key.pfik_name); - if (q != NULL) + p = pfi_lookup_if(name); + if (p == NULL && q != NULL) p = pfi_if_create(name, q, PFI_IFLAG_INSTANCE); } splx(s);