kern/54059: panic when detecting SATA devices on virtual box

[martin%NetBSD.org@localhost]

>Number:         54059
>Category:       kern
>Synopsis:       panic when detecting SATA devices on virtual box
>Confidential:   no
>Severity:       serious
>Priority:       high
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Thu Mar 14 14:30:00 +0000 2019
>Originator:     Martin Husemann
>Release:        NetBSD 8.99.35
>Organization:
The NetBSD Foundation, Inc.
>Environment:
System: NetBSD night-porter.duskware.de 8.99.35 NetBSD 8.99.35 (PORTER) #13: Sat Mar 9 16:26:42 CET 2019 martin%seven-days-to-the-wolves.aprisoft.de@localhost:/work/src/sys/arch/i386/compile/PORTER i386
Architecture: i386
Machine: i386
>Description:

Trying to boot a -current i386 install ISO on VirtualBox 5.2.26
set to use SATA (instead of IDE) panics in the atabus thread:

atabus_thread->atabusconfig->wdc_drvprobe->wdcprobe1 + 0x2df

0xc0573054 is in wdcprobe1 (/work/src/sys/dev/ic/wdc.c:672).
667                             }
668                     }
669     
670                     if (ret_value == 0) {
671                             ata_channel_unlock(chp);
672                             return 0;

doing an Xspllower and crashing at Xspllower + 0x10 - which should not
exist:

(gdb) x/16i Xspllower      
   0xc0100e10 <Xspllower>:      push   %ebp
   0xc0100e11 <Xspllower+1>:    mov    %esp,%ebp
   0xc0100e13 <Xspllower+3>:    push   %ebx
   0xc0100e14 <Xspllower+4>:    push   %esi
   0xc0100e15 <Xspllower+5>:    push   %edi
   0xc0100e16 <Xspllower+6>:    mov    0x8(%ebp),%ebx
   0xc0100e19 <Xspllower+9>:    mov    $0xc0100e1f,%esi
   0xc0100e1e <Xspllower+14>:   cli    
   0xc0100e1f <Xspllower+15>:   mov    %ebx,%eax
   0xc0100e21 <Xspllower+17>:   mov    %fs:0x2ac(,%eax,4),%eax
   0xc0100e29 <Xspllower+25>:   and    %fs:0x278,%eax
   0xc0100e30 <Xspllower+32>:   je     0xc0100e48 <Xspllower+56>
   0xc0100e32 <Xspllower+34>:   bsr    %eax,%eax
   0xc0100e35 <Xspllower+37>:   btr    %eax,%fs:0x278
   0xc0100e3d <Xspllower+45>:   mov    %fs:0x1ec(,%eax,4),%eax
   0xc0100e45 <Xspllower+53>:   jmp    *0x10(%eax)

Makes no sense to me - just to make sure I did not mistranscribe it,
here are two screenshots:

	https://NetBSD.org/~martin/panic1.png
	https://NetBSD.org/~martin/panic2.png

>How-To-Repeat:

Configure a i386 virtual box machine with controller = AHCI/SATA and
try to boot a current ISO.

>Fix:
n/a