Freeze with netmap TX stalls on I226-V (igcx) + Zenarmor on OPNsense 26.7

Follow

Prprprmxmxmx

• September 28, 2026 01:07
• Edited

Hi Zenarmor team and community,

I experienced a severe stability issue with Zenarmor on OPNsense and would like to share details and ask for feedback.

## My problem

On 27–28 Sep 2026, my OPNsense firewall became completely unresponsive and required a hard reboot.
System logs show repeated netmap TX stalls on igc1 (LAN) for about 4 hours:

<13>1 2026-09-27T21:30:39+02:00 OPNsense kernel -  netmap_transmit igcx full hwcur 515 hwtail 515 qlen 1023
<13>1 2026-09-28T01:21:37+02:00 OPNsense kernel -  netmap_transmit igcx full hwcur 515 hwtail 515 qlen 1023

No kernel panic, but the system was frozen (no SSH, no web UI, no ping).

## Hardware / Software

- CPU: Intel Celeron N5105
- NIC: 4x Intel I226-V (igcx)
- OPNsense version: OPNsense 26.7.4_1-amd64
- Zenarmor: Enabled, netmap active on multiple VLANs (LAN + several VLANs )
- Suricata: Installed but currently disabled

## Stabilization measures applied

After the incident, I applied the following tunables and startup script:

### Tunables

# Disable TCP Segmentation Offload
net.inet.tcp.tso = 0

# Disable LRO on igcx (LAN)
dev.igc.x.lro = 0

# Disable EEE on all I226-V ports
dev.igc.x.eee_control = 0
dev.igc.x.eee_control = 0
dev.igc.x.eee_control = 0
dev.igc.x.eee_control = 0

# Disable PCIe ASPM
hw.pci.enable_aspm = 0

# Limit ZFS ARC for Zenarmor
vfs.zfs.arc_max = 3221225472

### Startup script (forced 1G full-duplex)

#!/bin/sh
ifconfig igcx media 1000baseT mediaopt full-duplex
ifconfig igcx media 1000baseT mediaopt full-duplex
ifconfig igcx media 1000baseT mediaopt full-duplex
ifconfig igcx media 1000baseT mediaopt full-duplex

## Result after reboot

After applying these changes and rebooting:

- sysctl net.inet.tcp.tso → 0
- No more "netmap_transmit igcx full" messages in system logs
- ifconfig igc1 shows: media: Ethernet 1000baseT <full-duplex>, status: active
- Firewall and Zenarmor are working correctly

 

I am waiting for their feedback and will update this thread if they provide any useful information or fix.

## Questions

1. Has anyone else experienced netmap TX stalls (not just CPU 100%) with Zenarmor on I226-V?
2. Are these measures (TSO/LRO/EEE/ASPM off + 1G forced) sufficient to prevent future freezes?
3. Any known issues or planned fixes in the igc driver for netmap + I226-V under load?

Thanks in advance for any feedback.

0

• 

  SVN Support Team

  • September 28, 2026 10:32

  Hi There,

  Thank you for reporting this issue. We have received your ticket and are currently investigating it.

   

  Best regards

  0

  Comment actions Permalink
• 

  Andris Tute

  • October 27, 2026 07:27

  I'm having exactly same issue with same hw and service configuration. "2026-10-27T06:57:25Noticekernel[331166] 045.736290 [4335] netmap_transmit igc0 full hwcur 14 hwtail 14 qlen 1023
  2026-10-27T06:57:24Noticekernel[331165] 044.223457 [4335] netmap_transmit igc0 full hwcur 14 hwtail 14 qlen 1023". Hard reset brought back connectivity, but it now happened 2nd time over last 5 days.

  - CPU: Intel Celeron N5105
  - NIC: 4x Intel I226-V (igcx)
  - OPNsense version: OPNsense 26.7.7
  - Zenarmor: Enabled, netmap active on multiple VLANs (LAN + several VLANs )
  - Suricata: Installed but currently disabled

   

  Prprprmxmxmx was your ticket solved?

  0

  Comment actions Permalink

Please sign in to leave a comment.