When a carp(4) interface is being destroyed and is in a promiscous mode,

first interface is detached from parent and then bpfdetach() is called.
If the interface was the last carp(4) interface attached to parent, then
the mutex on parent is destroyed. When bpfdetach() calls if_setflags()
we panic on destroyed mutex.

To prevent the above scenario, clear pointer to parent, when we detach
ourselves from parent.

sys/netinet/ip_carp.c

@@ -443,6 +443,7 @@ carp_clone_destroy(struct ifnet *ifp)
 			CARP_LOCK_DESTROY(cif);
 			FREE(cif, M_CARP);
 			ifpromisc(sc->sc_carpdev, 0);
+			sc->sc_carpdev = NULL;
 		} else {
 			CARP_UNLOCK(cif);
 		}