crash from ohci detach

["Steven M. Bellovin" <smb%cs.columbia.edu@localhost>]

I'm experiencing a repeatable crash the *second* time I remove a
Cardbus EVDO card.  Here's what the attach looks like:

        ohci0 at cardbus0 function 0: NEC USB Host Controller (rev. 0x43)
        ohci0: interrupting at 11
        ohci0: OHCI version 1.0
        usb3 at ohci0: USB revision 1.0
        uhub3 at usb3
        uhub3: NEC OHCI root hub, class 9/0, rev 1.00/1.00, addr 1
        uhub3: 1 port with 1 removable, self powered
        ohci1 at cardbus0 function 1: NEC USB Host Controller (rev. 0x43)
        ohci1: interrupting at 11
        ohci1: OHCI version 1.0
        usb4 at ohci1: USB revision 1.0
        uhub4 at usb4
        uhub4: NEC OHCI root hub, class 9/0, rev 1.00/1.00, addr 1
        uhub4: 1 port with 1 removable, self powered
        umodem0 at uhub3 port 1 configuration 1 interface 0
        Jan  2 17:30:24 berkshire /netbsd:
        umodem0: Curitel Communications, Inc. Curitel Communications, Inc., rev 
1.10/0.00, addr 2, iclass 2/2
        umodem0: data interface 1, has CM over data, has break
        umodem0: status change notification available
        ucom0 at umodem0

I run ppp; on exit; I run

        drvctl -d ohci0; drvctl -d ohci1

The first time, everything is fine.  The second time, though, the system
crashes.  Worse yet, I don't get a crash dump; savecore says that there's
an invalid PTE and refuses to proceed, even with -f.  

Eyeballing the panic, it says "ohci_intr:... bad address" followed by
a uvm_fault.  These are both consistent with a bad PTE...

The problem started some time after the PM merge.  A locking problem?
A register/deregister problem?  (It happened even before my addition
of pmf_register/pmf_deregister to ucom.c.  There are not yet any calls
to pmf_register/pmf_deregister in umodem.c; this needs to be fixed as well,
but I suspect it's a separate issue.)

Suggestions on how to approach debugging this?  The machine is a laptop
with no serial port, so I can't set up a serial console.

                --Steve Bellovin, http://www.cs.columbia.edu/~smb