In article <20050711160721.GA25386@grouper.salmi.ch>,
Jukka Salmi  <j+nbsd@2005.salmi.ch> wrote:
>Hi,
>
>a i386 system running -current (3.99.7) crashed after I issued a
>'shutdown -h now'. Unfortunately I didn't have enough time to write down
>kernel output, but IIRC it crashed in ksh. After a 'tr /l' and a reboot
>the message buffer contained the following:
>
>uvm_fault(0xcaa48d20, 0, 0, 1) -> 0xe
>spec_ioctl(cb82bce4,cb82bd0c,0,c0933000,c062d7a0) at netbsd:spec_ioctl+0xe
>VOP_IOCTL(cb4e0a84,802c7415,cb82bea4,3,ffffffff) at netbsd:VOP_IOCTL+0x40
>cttyioctl(100,802c7415,cb82bea4,3,cb7fc1a4) at netbsd:cttyioctl+0x52
>spec_ioctl(cb82bd84,1e3ae000,cb82bdfc,c044cb32,c062d7a0) at
>netbsd:spec_ioctl+0x46
>VOP_IOCTL(cb4ef89c,802c7415,cb82bea4,3,cb7f6100) at netbsd:VOP_IOCTL+0x40
>vn_ioctl(cb7f5c0c,802c7415,cb82bea4,cb7fc1a4,0) at netbsd:vn_ioctl+0x9a
>sys_ioctl(cb840088,cb82bf64,cb82bf5c,0,c1338948) at netbsd:sys_ioctl+0x122
>syscall_plain() at netbsd:syscall_plain+0x7e
>--- syscall (number 54) ---
>0xbdbc7647:
>syncing disks... 5 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1
>
>Just in case this is useful to someone... However, I couldn't reproduce
>the crash so far.

It is dying on this line:

	dev_t dev = ap->a_vp->v_rdev;

When it de-references ap->a_vp. Is the vnode pointer corrupted? It will
be hard to tell without a register dump...

christos