> I think obj on NFS is necessary to trip the problem; the faulting 
> address on my system is within the pager_map address range, and pageout 
> to FFS vs NFS have definitely behaved differently in the past :-)

Hm, this reminds me recent nfs_vnops change; nfs_writerpc is changed
to avoid data copy if possible, and mbuf refers the mapped page
directly in the case.  If such mbuf (or shared ext. reference?)
survives after biodone, similar fault may occur.

enami.