****	Ok - I've tracked it down to:

_vrele(f877c100, c, 0, 0, f80d2c00, f9b70bec) at _vrele+0x4c
_nfsrv_rename(0, f8786780, f8780800, f877c100, f86c042c, f8787300) at 
	_nfsrv_rename+0x5f4 [/sys/arch/sparc/compile/_SUN4C+DDB_/:1004]
_nfssvc_nfsd(f86faf00, 2, a0, f9b70df8, f80d9400, f80ee5fc) at 
	_nfssvc_nfsd+0x51c [/sys/arch/sparc/compile/_SUN4C+DDB_/:550]
_nfssvc(0, f9b70f28, f9b70f20, f807da5c, 6, 145d8) at _nfssvc+0x438 
	[/sys/arch/sparc/compile/_SUN4C+DDB_/:284]
_syscall(9b, f9b70fb0, 30c8, f7fffda8, 0, 0) at _syscall+0x1ec 
	[/sys/arch/sparc/compile/_SUN4C+DDB_/:2562]
_trapbase(4, 19ff0, 18, 206c, 11400084, f9b68fb0) at _trapbase+0x267c
db>

****	which looks something like:

out1:
        vrele(fromnd.ni_startdir);
        FREE(fromnd.ni_cnd.cn_pnbuf, M_NAMEI); 
        nfsm_reply(0);				<----1004 ****
        return (error);
 
**** now nfsm_reply() is a macros that expands to:

#define nfsm_reply(s) \
                { \
                nfsd->nd_repstat = error; \
                if (error) \
                   (void) nfs_rephead(0, nfsd, error, cache, &frev, \
                        mrq, &mb, &bpos); \
                else \
                   (void) nfs_rephead((s), nfsd, error, cache, &frev, \
                        mrq, &mb, &bpos); \
                m_freem(mrep); \
                mreq = *mrq; \
                if (error) \
                        return(0); \
                }

**** I'm guessing that something is being multiply freed - the
**** m_freem(mrep) maybe?
****
**** I'm currently wading around with a meat cleaver in that region
**** making wild guesses as to what might work. - Any help _really_ 
**** appreciated! :)

		David/abs

 D.K.Brownlee@city.ac.uk (MIME) +44 171 477 8186  {post,host}master  (abs)
Network Analyst, UCS, City University, Northampton Square, London EC1V 0HB.
        <<< Monochrome - Largest UK Internet BBS - telnet mono.org >>>
>=- Microsoft: Abort and Retry Cancel -or- NetBSD: http://www.netbsd.org -=<