getfsstat in vfs_syscalls.c does not lock any mount points as it traverses
the list. This results in a possible rase condition, wherein the next mount 
point on the mount list is unmounted, while the current process is blocked
either in VFS_STATFS or in copyout. When the current process resumes, it
uses a pointer that is no longer valid.

Appended is a shell script that reproduces the error.

- Tor Egge

----- crasher shell script. Replace nova.pvv.unit.no:/store/store/nova with
----- something appropiate, that you are able to mount via NFS.     
#!/bin/sh
test -d /kern || mkdir /kern
umount /kern
mount -t nfs -o -P nova.pvv.unit.no:/store/store/nova /mnt
( while mount -t kernfs kernfs /kern
  do
    umount /kern
  done
) &

while df 
do
  :
done
-----