After two days of running with DDB, I have had ~8 crashes which sort out
to the following problems:

1) panic: page fault trap, code = 0 in _sorflush() called:
_closef->_soo_close->_soclose->_uipc_usrreq->_unp_detach->_sorflush

2) misc malloc related panics
_write->__soo_write->_sosend->_malloc() PANIC
_tcp_output->_malloc->_kmem_malloc->_lock_write->_thread_sleep + 0x1c PANIC
_nfssvc->_nfssvc_nfsd->_nfsrv_read->_malloc + 0x432 PANIC
_malloc is called as _malloc(80,1,...) in all above cases.

3) page fault in comstart (this occurs when toggling the modem off and on
or in some other nasty lock situations on the com port when you turn off the
modem -- I think I can reproduce this by setting &D0 to ignore DTR, dialing 
to somewhere, killing the process, and then toggling the modem power)
_spec_write->_comwrite->_ttwrite->_ttstart->_comstart() + 0x9c


I believe 1 and 2 are the bugs introduced into the i386 near the beginning 
of July.  3 is a long standing problem with the com driver that happens only
rarely.

I can provide more details on most of these crashes as I have a lot of
it written down on paper.

-j