something is corrupting the address stored in dev_priv->mmio. i instrumented radeon_get_vblank_counter() and got this panic: panic: ommio (0xffff8000062e5980) != dev_priv->mmio (0xffff8000062e5900) and then it failed to enter ddb as usual, hinting that something else is also corrupting the stack... .mrg.