I got the following panic:

nfs server dahan:/usr: not responding
nfs server dahan:/usr: is alive again
vrele: bad ref count: type VDIR, usecount -1, writecount 0, refcount 1,
        tag VT_UFS, ino 1059, on dev 0, 0 not locked
panic: vrele: ref cnt
syncing disks... 12 11 9 3 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 giving up

on this machine:
NetBSD sloth.metonymy.com 1.4K NetBSD 1.4K (SLOTH) #199: Wed Oct  6 03:30:29 CDT 1999     khym@dahan.metonymy.com:/usr/src.local/sys/arch/i386/compile/SLOTH i386

I had NFS mounted dahan:/usr, then forgot about it and rebooted dahan
into Windoze. In the meantime, sloth ran its daily filesystem checks and
got stuck waiting for the NFS server. After I rebooted dahan back into
NetBSD, sloth's daily script started back up again, then the machine
panicked soon after. Sloth's a 386/33, 8MB RAM.

I've got a crash dump and kernel with debugging symbols if anyone
wants to look at 'em. gdb seemed a bit unhappy about giving me a stack
trace though:

#0  0xf0213ee0 in netcls ()
#1  0x406000 in ?? ()
#2  0xf01ed847 in cpu_reboot (howto=256, bootstr=0x0)
    at ../../../../arch/i386/i386/machdep.c:1211
#3  0xf013dbcc in log (level=-266256672, fmt=0xf0213ecb "vrele: bad ref count")
    at ../../../../kern/subr_prf.c:217
#4  0xf01551ec in vrele (vp=0xf1b3ad18) at ../../../../kern/vfs_subr.c:986
can not access 0xefbfddae, invalid translation (invalid PDE)
can not access 0xefbfddae, invalid translation (invalid PDE)
can not access 0xefbfddae, invalid translation (invalid PDE)
can not access 0xefbfddae, invalid translation (invalid PDE)
#5  0xf015aa87 in rename_files (
    from=0xefbfddae <Address 0xefbfddae out of bounds>can not access 0xefbfddcc, invalid translation (invalid PDE)
can not access 0xefbfddcc, invalid translation (invalid PDE)
can not access 0xefbfddcc, invalid translation (invalid PDE)
can not access 0xefbfddcc, invalid translation (invalid PDE)
,
    to=0xefbfddcc <Address 0xefbfddcc out of bounds>, p=0xf1af8c80, retain=0)
    at ../../../../kern/vfs_syscalls.c:2801
#6  0xf015a6ad in sys_rename (p=0xf1af8c80, v=0xf1b8cf88, retval=0xf1b8cf80)
    at ../../../../kern/vfs_syscalls.c:2690
#7  0xf01f6280 in syscall (frame={tf_es = 31, tf_ds = 31, tf_edi = -272637968,
      tf_esi = 2, tf_ebp = -272639908, tf_ebx = -272638652,
      tf_edx = -272638546, tf_ecx = 45, tf_eax = 128, tf_trapno = 3,
      tf_err = 2, tf_eip = 134530987, tf_cs = 23, tf_eflags = 514,
      tf_esp = -272640044, tf_ss = 31, tf_vm86_es = 0, tf_vm86_ds = 0,
      tf_vm86_fs = 0, tf_vm86_gs = 0}) at ../../../../arch/i386/i386/trap.c:760
#8  0xf0100e29 in syscall1 ()
can not access 0xefbfd85c, invalid translation (invalid PDE)
can not access 0xefbfd85c, invalid translation (invalid PDE)
Cannot access memory at address 0xefbfd85c.

The machine was up for over 60 days before it died though... not bad :)
-- 
Name: Dave Huang     |   Mammal, mammal / their names are called /
INet: khym@bga.com   |   they raise a paw / the bat, the cat /
FurryMUCK: Dahan     |   dolphin and dog / koala bear and hog -- TMBG
Dahan: Hani G Y+C 24 Y++ L+++ W- C++ T++ A+ E+ S++ V++ F- Q+++ P+ B+ PA+ PL++