kern/46208: 6.0_BETA crash (uvm_unmap_remove -> pmap_remove_ptes -> pmap_remove_pte)

[cheusov%tut.by@localhost]

>Number:         46208
>Category:       kern
>Synopsis:       6.0_BETA crash (uvm_unmap_remove -> pmap_remove_ptes -> 
>pmap_remove_pte)
>Confidential:   no
>Severity:       critical
>Priority:       high
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Fri Mar 16 09:45:00 +0000 2012
>Originator:     Aleksey Cheusov
>Release:        NetBSD 6.0_BETA
>Organization:
>Environment:
System: NetBSD work.imb.invention.com 6.0_BETA NetBSD 6.0_BETA (GENERIC) #0: 
Mon Mar 12 17:25:05 FET 2012 
cheusov%work.imb.invention.com@localhost:/srv/obj-current/sys/arch/i386/compile/GENERIC
 i386
Architecture: i386
Machine: i386
>Description:
6.0_BETA crashes immediately after xdm login and is reproducible.

Kernel is GENEFIC with the following changes
   options        DEBUG
   makeoptions    DEBUG="-g"

Latest sources (2012-03-16) from netbsd-6.

Stacktrace is below.
#0  0xc05c4a03 in maybe_dump (howto=260) at 
/srv/src_netbsd_current/sys/arch/i386/i386/machdep.c:878
#1  cpu_reboot (howto=260, bootstr=0x0) at 
/srv/src_netbsd_current/sys/arch/i386/i386/machdep.c:903
#2  0xc07c1c1a in vpanic (fmt=0xc0c2098f "trap", ap=0xdbdb5864 "garbagehere") 
at /srv/src_netbsd_current/sys/kern/subr_prf.c:308
#3  0xc07c1cbf in panic (fmt=0xc0c2098f "trap") at 
/srv/src_netbsd_current/sys/kern/subr_prf.c:205
#4  0xc081e860 in trap (frame=0xdbdb5904) at 
/srv/src_netbsd_current/sys/arch/i386/i386/trap.c:396
#5  0xc010d08f in ?? ()
#6  0xc06985e1 in pmap_remove_pte (pmap=<optimized out>, ptp=0xc2faa158, 
pte=<optimized out>, va=3141660672, pv_tofree=0xdbdb59f4) at 
/srv/src_netbsd_current/sys/arch/x86/x86/pmap.c:3326
#7  0xc069c19a in pmap_remove_ptes (pv_tofree=0xdbdb59f4, endva=<optimized 
out>, startva=3141660672, ptpva=<optimized out>, ptp=<optimized out>, 
pmap=<optimized out>) at /srv/src_netbsd_current/sys/arch/x86/x86/pmap.c:3252
#8  pmap_remove (pmap=0xc3800b40, sva=3141660672, eva=3141668864) at 
/srv/src_netbsd_current/sys/arch/x86/x86/pmap.c:3444
#9  0xc08be4b9 in uvm_unmap_remove (map=0xc37ff5e8, start=<optimized out>, 
end=3217031168, entry_list=0xdbdb5ac0, flags=0) at 
/srv/src_netbsd_current/sys/uvm/uvm_map.c:2262
#10 0xc08be83f in uvmspace_free (vm=0xc37ff5e8) at 
/srv/src_netbsd_current/sys/uvm/uvm_map.c:4183
#11 0xc05425d7 in exit1 (l=0xc48b2560, rv=134) at 
/srv/src_netbsd_current/sys/kern/kern_exit.c:327
#12 0xc0561568 in sigexit (l=0xc48b2560, signo=6) at 
/srv/src_netbsd_current/sys/kern/kern_sig.c:2235
#13 0xc05618c8 in postsig (signo=6) at 
/srv/src_netbsd_current/sys/kern/kern_sig.c:2032
#14 0xc054ac5d in lwp_userret (l=0xc48b2560) at 
/srv/src_netbsd_current/sys/kern/kern_lwp.c:1403
#15 0xc07e6563 in mi_userret (l=0xc48b2560) at 
/srv/src_netbsd_current/sys/sys/userret.h:96
#16 userret (l=0xc48b2560) at ./machine/userret.h:78
#17 syscall (frame=0xdbdb5d48) at 
/srv/src_netbsd_current/sys/arch/x86/x86/syscall.c:208

>How-To-Repeat:
See above
>Fix:
no idea