> From: David Brownlee <abs@netbsd.org>
> bsize   32768   shift   15      mask    0xffff8000
> fsize   4096    shift   12      mask    0xfffff000

I also could reproduce same panic using same block/frag size.  And
following patch fixes for me.  We can't leave valid data in cache if
tried block isn't real super block.  If we leave it, and some other
data (in this case cg) starts exact same offset with larger size,
we'll see junk at the end of chunk.

enami.

Index: ffs_vfsops.c
===================================================================
RCS file: /cvsroot/src/sys/ufs/ffs/ffs_vfsops.c,v
retrieving revision 1.111
diff -u -r1.111 ffs_vfsops.c
--- ffs_vfsops.c	5 Apr 2003 13:37:36 -0000	1.111
+++ ffs_vfsops.c	12 Apr 2003 09:00:10 -0000
@@ -743,16 +743,16 @@
 			fsblockloc = bswap64(fs->fs_sblockloc);
 			needswap = 1;
 #endif
-		} else {
-			brelse(bp);
-			bp = NULL;
-			continue;
-		}
+		} else
+			goto next_sblock;
 
 		if ((fsblockloc == sblockloc ||
 		     (fs->fs_old_flags & FS_FLAGS_UPDATED) == 0)
 		    && sbsize <= MAXBSIZE && sbsize >= sizeof(struct fs))
 			break;
+
+next_sblock:
+		bp->b_flags |= B_NOCACHE;
 		brelse(bp);
 		bp = NULL;
 	}