There was a possible recursion that could eventually overflow the stack. The error occurred when closing the socket with inet_close() while a socket callback was still queued. When the socket callback was executed by devif_conn_event(), this resulted in a call to psock_send_eventhandler() with TCP_CLOSE flag set which then called tcp_lost_connection(). tcp_shutdown_monitor() then called tcp_callback() again, which again called psock_send_eventhandler(), and so on.... Noted by Pascal Speck. Solution is also similar to a solution proposed by Pascal Speck.

net/devif/devif_callback.c

@@ -102,18 +102,18 @@ static void devif_callback_free(FAR struct net_driver_s *dev,
        * it is supposed to be in the device notification list.
        */
 
-      if (dev)
+      if (dev != NULL)
         {
           /* Find the callback structure in the device event list */
 
           for (prev = NULL, curr = dev->d_devcb;
-               curr && curr != cb;
+               curr != NULL && curr != cb;
                prev = curr, curr = curr->nxtdev);
 
           /* Remove the structure from the device event list */
 
           DEBUGASSERT(curr);
-          if (curr)
+          if (curr != NULL)
             {
               if (prev)
                 {