I've tracked down the code that causes panics in csh(1).

It's the following code in bin/csh/csh.c:

/*
 * Move the initial descriptors to their eventual
 * resting places, closing all other units.
 */
void   
initdesc(void) 
{
    didfds = 0;                 /* 0, 1, 2 aren't set up */
    (void)ioctl(SHIN = dcopy(0, FSHIN), FIOCLEX, NULL);
    (void)ioctl(SHOUT = dcopy(1, FSHOUT), FIOCLEX, NULL); 
    (void)ioctl(SHERR = dcopy(2, FSHERR), FIOCLEX, NULL);
    (void)ioctl(OLDSTD = dcopy(SHIN, FOLDSTD), FIOCLEX, NULL);
    closem();
}

closem() completes.  However initdesc() never returns to the main
section where it's called from--this is when the cache panic occurs.

Don't know if this help anyone who might look into the issue.

-scott