The symptom matches starting two ntpd that bind to the same interfaces (or where IP address is wildcarded). That, coupled with observation of a very low pid (38) and very high pid (79840) made me think that the latter must have been started from a jail. I would double check what jails do.Yes, I have 4 jails, but only one ntpd service at host.
fork-bomb is not english. It is unix-nerd-speak