panic upon reboot

[Tom Spindler <dogcow%babymeat.com@localhost>]

I have a read-only null mount on my box; if I boot to single user,
and then `fsck -yp; mount -a; reboot`, I get the following panic:

panic: free 2: inuse 0, probable double free

backtrace is as follows.
#0  cpu_reboot (howto=260, bootstr=0x0)
    at /usr/src/sys/arch/i386/i386/machdep.c:894
#1  0xc02d0326 in panic (
    fmt=0xc0492c90 "free 2: inuse 0, probable double free")
    at /usr/src/sys/kern/subr_prf.c:260
#2  0xc0298e08 in free (addr=0xc1d02180, ksp=0xc0502a40)
    at /usr/src/sys/kern/kern_malloc.c:650
#3  0xc02203e6 in ffs_unmount (mp=0xccaa8004, mntflags=524288)
    at /usr/src/sys/ufs/ffs/ffs_vfsops.c:1236
#4  0xc031e894 in VFS_UNMOUNT (mp=0xccaa8004, a=524288)
    at /usr/src/sys/kern/vfs_subr2.c:1037
#5  0xc03206c0 in dounmount (mp=0xccaa8004, flags=524288, l=0xccae07c0)
    at /usr/src/sys/kern/vfs_syscalls.c:762
#6  0xc031c334 in vfs_unmountall (l=0xccae07c0)
    at /usr/src/sys/kern/vfs_subr.c:1720
#7  0xc031c42e in vfs_shutdown () at /usr/src/sys/kern/vfs_subr.c:1777
#8  0xc0373f26 in cpu_reboot (howto=0, bootstr=0x0)
    at /usr/src/sys/arch/i386/i386/machdep.c:877
#9  0xc02be2df in sys_reboot (l=0xccae07c0, uap=0xccacdcf0, retval=0xccacdce8)
    at /usr/src/sys/kern/kern_xxx.c:78
#10 0xc037a7a8 in syscall (frame=0xccacdd48)
    at /usr/src/sys/arch/i386/i386/syscall.c:102
#11 0xc010056d in syscall1 ()