Lately, particularly when using mplayer, I'm getting the following
series of panics:
#0  0xc02894ca in cpu_reboot (howto=0, bootstr=0x0)
    at /usr/src/sys/arch/i386/i386/machdep.c:910
#1  0xc0228978 in panic (fmt=0x0) at /usr/src/sys/kern/subr_prf.c:246
#2  0xc029548e in trap (frame=0xcbd435b0)
    at /usr/src/sys/arch/i386/i386/trap.c:336
#3  0xc0102f01 in calltrap ()
#4  0xc02857e0 in db_read_bytes (addr=6, size=4, 
    data=0xcbd4361c "ุ\211สหุ\211สห\001")
    at /usr/src/sys/arch/i386/i386/db_memrw.c:98
#5  0xc013bcc3 in db_get_value (addr=6, size=4, is_signed=0)
    at /usr/src/sys/ddb/db_access.c:62
#6  0xc0285f8f in db_stack_trace_print (addr=-875284720, have_addr=1, 
    count=65535, modif=0xc0382b20 "", pr=0xc02287b0 <printf>)
    at /usr/src/sys/arch/i386/i386/db_trace.c:467
#7  0xc0228949 in panic (fmt=0xc038e219 "trap")
    at /usr/src/sys/kern/subr_prf.c:235
#8  0xc029548e in trap (frame=0xcbd437b4)
    at /usr/src/sys/arch/i386/i386/trap.c:336
#9  0xc0102f01 in calltrap ()
#10 0xc01be1c6 in uvm_map_lookup_entry (map=0xc03f1c40, address=3394859008, 
    entry=0xcbd43944) at /usr/src/sys/uvm/uvm_map.c:1538
#11 0xc01b87d2 in uvm_fault_internal (orig_map=0xc03f1c40, vaddr=3394859008, 
    access_type=2, fault_flag=0) at /usr/src/sys/uvm/uvm_fault_i.h:141
#12 0xc0295bcd in trap (frame=0xcbd43a08)
    at /usr/src/sys/arch/i386/i386/trap.c:634
#13 0xc0102f01 in calltrap ()
#14 0xc0100a5d in copyinstr ()
[gobbledygook from here]

The first panic arises from this:
#10 0xc01be1c6 in uvm_map_lookup_entry (map=0xc03f1c40, address=3394859008, 
    entry=0xcbd43944) at /usr/src/sys/uvm/uvm_map.c:1538
1538            KDASSERT((*entry)->next == &map->header ||
1539                address < (*entry)->next->start);
(gdb) print &map->header
$3 = (struct vm_map_entry *) 0xc03f1c74
(gdb) print (*entry)->next
$4 = (struct vm_map_entry *) 0x0

(Presumably, the extra high-larity comes from the assert trying to deref
null.)

kvm core image or PRs filed on request.