gdb> bt
#0  0xc0544000 in ?? ()
#1  0xc02eaaf8 in cpu_reboot (howto=0x100, bootstr=0x0)
    at /usr/src/sys/arch/i386/i386/machdep.c:745
#2  0xc022b1ef in db_sync_cmd (addr=0xc02e7814, have_addr=0x0, count=0x0,
    modif=0xc77b2380 "") at /usr/src/sys/ddb/db_command.c:750
#3  0xc022aba7 in db_command (last_cmdp=0xc03e0c14, cmd_table=0xc038b540)
    at /usr/src/sys/ddb/db_command.c:464
#4  0xc022a889 in db_command_loop () at /usr/src/sys/ddb/db_command.c:255
#5  0xc022dfa7 in db_trap (type=0x1, code=0x0)
    at /usr/src/sys/ddb/db_trap.c:101
#6  0xc02e7701 in kdb_trap (type=0x1, code=0x0, regs=0xc77b25e4)
    at /usr/src/sys/arch/i386/i386/db_interface.c:225
#7  0xc02f434c in trap (frame=0xc77b25e4)
    at /usr/src/sys/arch/i386/i386/trap.c:284
#8  0xc010aefd in calltrap ()
#9  0xc02767bb in panic (
    fmt=0xc03d94e0 "kernel %sassertion \"%s\" failed: file \"%s\", line %d")
    at /usr/src/sys/kern/subr_prf.c:226
#10 0xc037bdae in __assert (t=0xc039cf3d "diagnostic ",
    f=0xc03c6960 "/usr/src/sys/kern/kern_timeout.c", l=0x119,
    e=0xc03a49eb "to_ticks >= 0") at /usr/src/sys/lib/libkern/__assert.c:47
#11 0xc026e4bf in callout_schedule (c=0xc0d2992c, to_ticks=0xfffbd1e2)
    at /usr/src/sys/kern/kern_timeout.c:301
#12 0xc012a67f in tcp_output (tp=0xc0d29920)
    at /usr/src/sys/netinet/tcp_output.c:1119
#13 0xc012567e in tcp_input (m=0xc0d89d00)
    at /usr/src/sys/netinet/tcp_input.c:2439
#14 0xc011ebf0 in ip_input (m=0xc0d89d00)
    at /usr/src/sys/netinet/ip_input.c:1030
#15 0xc011e606 in ipintr () at /usr/src/sys/netinet/ip_input.c:474
#16 0xc010abd0 in Xsoftnet ()
#17 0xc02e2958 in softintr_dispatch (which=0x0) at x86/intr.h:168
gdb> frame
Stack level 0, frame at 0xc77b2328:
 eip = 0xc0544000; saved eip 0xc02eaaf8
 called by frame at 0xc77b2348
 Arglist at 0xc77b2328, args:
 Locals at 0xc77b2328, Previous frame's sp in esp
 Saved registers:
  ebp at 0xc77b2328, eip at 0xc77b232c
No symbol table info available.
No symbol table info available.
gdb> i all
eax            0x0      0x0
ecx            0x0      0x0
edx            0x0      0x0
ebx            0x0      0x0
esp            0xc77b22dc       0xc77b22dc
ebp            0xc77b2328       0xc77b2328
esi            0xb53c8  0xb53c8
edi            0x1      0x1
eip            0xc0544000       0xc0544000
eflags         0x0      0x0
cs             0x0      0x0
ss             0x0      0x0
ds             0x0      0x0
es             0x0      0x0
fs             0x0      0x0
gs             0x0      0x0
st0            0        (raw 0x00000000000000000000)
st1            0        (raw 0x00000000000000000000)
st2            0        (raw 0x00000000000000000000)
st3            0        (raw 0x00000000000000000000)
st4            0        (raw 0x00000000000000000000)
st5            0        (raw 0x00000000000000000000)
st6            0        (raw 0x00000000000000000000)
st7            0        (raw 0x00000000000000000000)
fctrl          0x0      0x0
fstat          0x0      0x0
ftag           0x0      0x0
fiseg          0x0      0x0
fioff          0x0      0x0
foseg          0x0      0x0
fooff          0x0      0x0
fop            0x0      0x0
mm0            {uint64 = 0x0, v2_int32 = {0x0, 0x0}, v4_int16 = {0x0, 0x0,
    0x0, 0x0}, v8_int8 = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}
mm1            {uint64 = 0x0, v2_int32 = {0x0, 0x0}, v4_int16 = {0x0, 0x0,
    0x0, 0x0}, v8_int8 = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}
mm2            {uint64 = 0x0, v2_int32 = {0x0, 0x0}, v4_int16 = {0x0, 0x0,
    0x0, 0x0}, v8_int8 = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}
mm3            {uint64 = 0x0, v2_int32 = {0x0, 0x0}, v4_int16 = {0x0, 0x0,
    0x0, 0x0}, v8_int8 = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}
mm4            {uint64 = 0x0, v2_int32 = {0x0, 0x0}, v4_int16 = {0x0, 0x0,
    0x0, 0x0}, v8_int8 = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}
mm5            {uint64 = 0x0, v2_int32 = {0x0, 0x0}, v4_int16 = {0x0, 0x0,
    0x0, 0x0}, v8_int8 = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}
mm6            {uint64 = 0x0, v2_int32 = {0x0, 0x0}, v4_int16 = {0x0, 0x0,
    0x0, 0x0}, v8_int8 = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}
mm7            {uint64 = 0x0, v2_int32 = {0x0, 0x0}, v4_int16 = {0x0, 0x0,
    0x0, 0x0}, v8_int8 = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}

# struct mbuf
gdb> x/64w 0xc0d89d00
0xc0d89d00:     0x00000000      0x00000000      0xc0d89d44      0xdeadbeef
0xc0d89d10:     0x00000034      0x00000002      0x0c153d00      0xdead0002
0xc0d89d20:     0x00000000      0x00000000      0x00000058      0x00000001
0xc0d89d30:     0x00000010      0xc5fe5800      0x00000000      0xc0474b20
0xc0d89d40:     0x00000800      0x00000045      0x00000000      0x14000600
0xc0d89d50:     0x0200000a      0x7be710d9      0x3512f3f6      0xc6bca8e3
0xc0d89d60:     0xfbb1283d      0x2c831080      0x0000b4ca      0x0a080101
0xc0d89d70:     0x1c000000      0x7f050000      0x02427d18      0xfb15fa65
0xc0d89d80:     0xfb15bb7a      0x11e3bb7a      0x4f000000      0xeb1322e1
0xc0d89d90:     0x7d1835a2      0xc039f45e      0x00000000      0x000006e0
0xc0d89da0:     0x00000000      0x00000002      0x26000103      0x00000003
0xc0d89db0:     0x55000102      0x4d61000b      0x20656c75      0x2e322e31
0xc0d89dc0:     0x0f000238      0x91ca5166      0xc45a1000      0x0008b97a
0xc0d89dd0:     0x2e000045      0x00005821      0x00001140      0x0200000a
0xc0d89de0:     0x55f61701      0xd6073912      0x9a011a00      0x22e19ae3
0xc0d89df0:     0x35a2eb13      0x02427d18      0xfb15fa65      0x0dc3bb7a

BTW, this crash never happened to me in RC5. As no kernel stuff was
changed between RC5 and RELEASE, may this be a hardware problem ? 
I find it odd that this 'bug' only started happening after my upgrade
to 2.0-RELEASE.

	-- Rui Paulo <rpaulo@netbsd-pt.org>