On Sat, Nov 18, 2006 at 10:55:02AM +0000, Tracy Di Marco White wrote:
> The following reply was made to PR kern/35071; it has been noted by GNATS.
> 
> From: Tracy Di Marco White <tjd-nb-pr@menelos.com>
> To: gnats-bugs@NetBSD.org
> Cc: 
> Subject: Re: kern/35071: panic: mpt_get_request: corrupted request free list (xfer) 
> Date: Sat, 18 Nov 2006 04:51:40 -0600
> 
>  I meant to include the console message prior to the panic, and show
>  uvm after.
>  mpt3: mpt_done: no scsipi_xfer, index = 0xfd, seq = 0x00000000
>  mpt3: request state: Free

I've seen something similar on a netbsd-3 host. I think the problem started
with:
sd1(mpt0:0:1:0): command timeout
mpt0: timeout on request index = 0xfb, seq = 0x0361bdae
mpt0: Status 0x00000000, Mask 0x00000001, Doorbell 0x24000000
mpt0: request state: On Chip

So maybe it's the timeout handling code which corrupts the list.
But I didn't look at the code at all.

-- 
Manuel Bouyer <bouyer@antioche.eu.org>
     NetBSD: 26 ans d'experience feront toujours la difference
--