panic: free: addr 0xce894000 not within kmem_map

(gdb) bt
#0  0x7fd86000 in ?? ()
#1  0xc04181ff in cpu_reboot (howto=256, bootstr=0x0)
     at /usr/src/sys/arch/i386/i386/machdep.c:751
#2  0xc0384554 in panic (fmt=0xc0751600 "free: addr %p not within 
kmem_map")
     at /usr/src/sys/kern/subr_prf.c:242
#3  0xc036933e in free (addr=0xce894000, ksp=0xc079fba0)
     at /usr/src/sys/kern/kern_malloc.c:555
#4  0xc0318436 in ffs_mountfs (devvp=0xce67a018, mp=0xc2ea7000, 
p=0xccbcccc4)
     at /usr/src/sys/ufs/ffs/ffs_vfsops.c:991
can not access 0xbfbfef74, invalid translation (invalid PDE)
can not access 0xbfbfef74, invalid translation (invalid PDE)
can not access 0xbfbfef74, invalid translation (invalid PDE)
can not access 0xbfbfef74, invalid translation (invalid PDE)
can not access 0xbfbfef74, invalid translation (invalid PDE)
can not access 0xbfbfef74, invalid translation (invalid PDE)
#5  0xc0317267 in ffs_mount (mp=0xc2ea7000,
     path=0xbfbfef74 <Address 0xbfbfef74 out of bounds>, data=0xbfbfede0,
     ndp=0xce847e54, p=0xccbcccc4) at 
/usr/src/sys/ufs/ffs/ffs_vfsops.c:290
#6  0xc03ab18e in sys_mount (l=0xccbcbce4, v=0xce847f64, 
retval=0xce847f5c)
     at /usr/src/sys/kern/vfs_syscalls.c:334
#7  0xc0422d07 in syscall_plain (frame=0xce847fa8)
     at /usr/src/sys/arch/i386/i386/syscall.c:161
(gdb)
(gdb) f 3
#3  0xc036933e in free (addr=0xce894000, ksp=0xc079fba0)
     at /usr/src/sys/kern/kern_malloc.c:555
555                             panic("free: duplicated free");
(gdb) f 4
#4  0xc0318436 in ffs_mountfs (devvp=0xce67a018, mp=0xc2ea7000, 
p=0xccbcccc4)
     at /usr/src/sys/ufs/ffs/ffs_vfsops.c:991
991                     free(fs, M_UFSMNT);
(gdb) i loc
ump = (struct ufsmount *) 0x0
bp = (struct buf *) 0xc2ec7094
fs = <incomplete type>
dev = 512
dpart = {disklab = 0xccbcccc4, part = 0xc28263f8}
space = (void *) 0x2000
sblockloc = 65536
fsblockloc = 0
fstype = 6
error = 5
i = -829865984
size = 512
ronly = 0
lp = (__int32_t *) 0xc0751600
cred = (struct ucred *) 0xccbc0000
sbsize = 3
(gdb)
(gdb) i loc
flags = 3
data = (void *) 0x0
ndp = (struct nameidata *) 0x3
devvp = (struct vnode *) 0xce67a018
can not access 0xbfbfef6a, invalid translation (invalid PDE)
can not access 0xbfbfef6a, invalid translation (invalid PDE)
can not access 0xbfbfef6a, invalid translation (invalid PDE)
can not access 0xbfbfef6a, invalid translation (invalid PDE)
can not access 0xbfbfef6a, invalid translation (invalid PDE)
can not access 0xbfbfef6a, invalid translation (invalid PDE)
args = {fspec = 0xbfbfef6a <Address 0xbfbfef6a out of bounds>, export = 
{
     ex_flags = 0, ex_root = 4294967294, ex_anon = {cr_unused = 47520,
       cr_uid = 3183400448, cr_gid = 3183400448, cr_ngroups = -7512,
       cr_groups = {3183265776, 0, 3183437129, 3183400448, 4912, 
3183332512,
         3183333056, 0, 0, 3183272616, 3217026644, 3183092555, 
3183265776,
         3217026792, 3183437129, 3183092401}}, ex_addr = 0xbdbdcca0,
     ex_addrlen = -1111694680, ex_mask = 0xbfbfee74, ex_masklen = 
-1111874741,
can not access 0xbdbcc7f0, invalid translation (invalid PDE)
can not access 0xbdbcc7f0, invalid translation (invalid PDE)
can not access 0xbdbcc7f0, invalid translation (invalid PDE)
can not access 0xbdbcc7f0, invalid translation (invalid PDE)
can not access 0xbdbcc7f0, invalid translation (invalid PDE)
can not access 0xbdbcc7f0, invalid translation (invalid PDE)
     ex_indexfile = 0xbdbcc7f0 <Address 0xbdbcc7f0 out of bounds>}}
ump = (struct ufsmount *) 0x3
fs = <incomplete type>
error = 0
flags = 0
update = 0
accessmode = 0
(gdb)