kern/39929: NetBSD 5.0_BETA kernel panics when trying to access /dev/rcd0d with growisofs

[th%risp.pl@localhost]

>Number:         39929
>Category:       kern
>Synopsis:       NetBSD 5.0_BETA kernel panics when trying to access /dev/rcd0d 
>with growisofs
>Confidential:   no
>Severity:       critical
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sat Nov 15 21:05:00 +0000 2008
>Originator:     Tomasz Homa
>Release:        5.0_BETA
>Organization:
NONE
>Environment:
NetBSD nbsd 5.0_BETA NetBSD 5.0_BETA (NBSD) #0: Mon Nov 10 21:39:13 CET 2008  
th@nbsd:/usr/src/sys/arch/i386/compile/NBSD i386
>Description:
I've just installed fresh 5.0_BETA to my laptop (ThinkPad R60). When trying to 
burn a DVD+/- with "growisofs -Z /dev/rcd0d=dvd1.iso" my system immediately 
crashes.

The most important (as I think) is kernel error:
=======================================
cd0(piixide0:0:0): Check Condition on CDB: 0x43 00 00 00 00 00 00 00 0c 40
SENSE KEY: Illegal Request
COMMAND INFO: 1124073486(0x4300000e)
ASC/ASCQ: Illegal Field in CDB
SKSV: Error in CDB, offset 6
 
cd0(piixide0:0:0): Check Condition on CDB: 0x28 00 00 00 00 00 00 00 01 00
SENSE KEY: Illegal Request
COMMAND INFO: 671088654 (0x2800000e)
ASC/ASCQ: Logical Block Address Out of Range
 
cd0: dos partition I/O error
cd0(piixide0:0:0): Check Condition on CDB: 0x43 00 00 00 00 00 00 00 0c 40
SENSE KEY: Illegal Request
COMMAND INFO: 1124073486(0x4300000e)
ASC/ASCQ: Illegal Field in CDB
SKSV: Error in CDB, offset 6
 
Executing 'builtin_dd if=dvd1.iso of=/dev/rcd0d obs=32k seek=0'
 
urm_fault(0xcc2e1a94, 0, 1) -> 0xe
fatal page fault in supervisor mode
trap type 6 code 0 eip c02f5f6e cs 8 eflags 10246 cr2 18 ilevel 0
kernel: supervisor trap page fault, code=0
Stopped in pid 400.1 (growisofs) at netbsd:genfs_directio+0x2e6: call
*
0x18(%edx)
db{0}>
=======================================

File type:
=======================================
$ file dvd1.iso
dvd1.iso: UDF filesystem data (version 1.5) swier1                         '
=======================================

Mounting it without a problem:
=======================================
nbsd# vnconfig vnd0 dvd1.iso
nbsd# mount -t cd9660 /dev/vnd0a /mnt
nbsd# ls /mnt
audio_ts video_ts
=======================================
(copied that DVD to .iso with "dd if=/dev/cd0a of=dvd1.iso")

...and here's dmesg:
--- DMESG ---
Copyright (c) 1996, 1997, 1998, 1999, 2000, 2001, 2002, 2003, 2004, 2005,
    2006, 2007, 2008
    The NetBSD Foundation, Inc.  All rights reserved.
Copyright (c) 1982, 1986, 1989, 1991, 1993
    The Regents of the University of California.  All rights reserved.

NetBSD 5.0_BETA (NBSD) #0: Mon Nov 10 21:39:13 CET 2008
        th@nbsd:/usr/src/sys/arch/i386/compile/NBSD
total memory = 1022 MB
avail memory = 999 MB
timecounter: Timecounters tick every 10.000 msec
timecounter: Timecounter "i8254" frequency 1193182 Hz quality 100
LENOVO 9461HRG (ThinkPad R60)
mainbus0 (root)
cpu0 at mainbus0 apid 0: Intel 686-class, 1828MHz, id 0x6f6
cpu0: Enhanced SpeedStep (1356 mV) 1833 MHz
cpu0: Enhanced SpeedStep frequencies available (MHz): 1833 1667 1500 1333 1167 
1000
cpu1 at mainbus0 apid 1: Intel 686-class, 1828MHz, id 0x6f6
ioapic0 at mainbus0 apid 1: pa 0xfec00000, version 20, 24 pins
acpi0 at mainbus0: Intel ACPICA 20080321
acpi0: X/RSDT: OemId <LENOVO,TP-7C   ,00002220>, AslId < LTP,00000000>
acpiecdt0 at acpi0: ACPI Embedded Controller via ECDT
acpi0: SCI interrupting at int 9
acpi0: fixed-feature power button present
timecounter: Timecounter "ACPI-Fast" frequency 3579545 Hz quality 1000
ACPI-Fast 24-bit timer
acpilid0 at acpi0 (LID, PNP0C0D): ACPI Lid Switch
acpibut0 at acpi0 (SLPB, PNP0C0E): ACPI Sleep Button
attimer0 at acpi0 (TIMR, PNP0100): AT Timer
attimer0: io 0x40-0x43 irq 0
hpet0 at acpi0 (HPET, PNP0103)
hpet0: mem 0xfed00000-0xfed003ff
timecounter: Timecounter "hpet0" frequency 14318179 Hz quality 2000
pcppi0 at acpi0 (SPKR, PNP0800)
pcppi0: io 0x61
midi0 at pcppi0: PC speaker (CPU-intensive output)
sysbeep0 at pcppi0
npx0 at acpi0 (FPU, PNP0C04)
npx0: io 0xf0 irq 13
npx0: reported by CPUID; using exception 16
pckbc0 at acpi0 (KBD, PNP0303): kbd port
pckbc0: io 0x60,0x64 irq 1
pckbc1 at acpi0 (MOU, IBM0057): aux port
pckbc1: irq 12
TPM (ATM1200) at acpi0 not configured
acpiec0 at acpi0 (EC, PNP0C09-0): ACPI Embedded Controller (disabled)
acpibat0 at acpi0 (BAT0, PNP0C0A-0): ACPI Battery (Control Method)
acpibat0: battery info: Panasonic, LION, 92P1139  1728
acpiacad0 at acpi0 (AC, ACPI0003-0): ACPI AC Adapter
thinkpad0 at acpi0 (HKEY, IBM0068)
thinkpad0: using CMOS at \UCMS
thinkpad0: using EC at acpiecdt0
acpitz0 at acpi0 (THM0): critical 127.0C, passive cooling
acpitz1 at acpi0 (THM1): critical 100.0C passive 30.0C, passive cooling
apm0 at acpi0: Power Management spec V1.2
attimer0: attached to pcppi0
pckbd0 at pckbc0 (kbd slot)
pckbc0: using irq 1 for kbd slot
wskbd0 at pckbd0: console keyboard
pms0 at pckbc0 (aux slot)
pms0: Synaptics touchpad version 6.2
pms0: Palm detect, Multi-finger
pckbc0: using irq 12 for aux slot
wsmouse0 at pms0 mux 0
pci0 at mainbus0 bus 0: configuration mode 1
pci0: i/o space, memory space enabled, rd/line, rd/mult, wr/inv ok
pchb0 at pci0 dev 0 function 0
pchb0: vendor 0x8086 product 0x27a0 (rev. 0x03)
agp0 at pchb0: can't find internal VGA device config space
ppb0 at pci0 dev 1 function 0: vendor 0x8086 product 0x27a1 (rev. 0x03)
pci1 at ppb0 bus 1
pci1: i/o space, memory space enabled, rd/line, wr/inv ok
vga0 at pci1 dev 0 function 0: vendor 0x1002 product 0x7145 (rev. 0x00)
wsdisplay0 at vga0 kbdmux 1: console (80x25, vt100 emulation), using wskbd0
wsmux1: connecting to wsdisplay0
drm at vga0 not configured
azalia0 at pci0 dev 27 function 0: Generic High Definition Audio Controller
azalia0: interrupting at ioapic0 pin 17
azalia0: host: 0x8086/0x27d8 (rev. 2), HDA rev. 1.0
ppb1 at pci0 dev 28 function 0: vendor 0x8086 product 0x27d0 (rev. 0x02)
ppb1: disabling notification events
pci2 at ppb1 bus 2
pci2: i/o space, memory space enabled, rd/line, wr/inv ok
bge0 at pci2 dev 0 function 0: Broadcom BCM5751M Gigabit Ethernet
bge0: interrupting at ioapic0 pin 16
bge0: ASIC unknown BCM575x family (0x4201), Ethernet address 00:16:d3:37:fb:ad
bge0: setting short Tx thresholds
brgphy0 at bge0 phy 1: BCM5750 1000BASE-T media interface, rev. 0
brgphy0: 10baseT, 10baseT-FDX, 100baseTX, 100baseTX-FDX, 1000baseT, 
1000baseT-FDX, auto
ppb2 at pci0 dev 28 function 1: vendor 0x8086 product 0x27d2 (rev. 0x02)
pci3 at ppb2 bus 3
pci3: i/o space, memory space enabled, rd/line, wr/inv ok
wpi0 at pci3 dev 0 function 0: vendor 0x8086 product 0x4227 (rev. 0x02)
wpi0: interrupting at ioapic0 pin 17
wpi0: MoW2, address 00:19:d2:97:1d:8f
wpi0: 11a rates: 6Mbps 9Mbps 12Mbps 18Mbps 24Mbps 36Mbps 48Mbps 54Mbps
wpi0: 11b rates: 1Mbps 2Mbps 5.5Mbps 11Mbps
wpi0: 11g rates: 1Mbps 2Mbps 5.5Mbps 11Mbps 6Mbps 9Mbps 12Mbps 18Mbps 24Mbps 
36Mbps 48Mbps 54Mbps
ppb3 at pci0 dev 28 function 2: vendor 0x8086 product 0x27d4 (rev. 0x02)
ppb3: disabling notification events
pci4 at ppb3 bus 4
pci4: i/o space, memory space enabled, rd/line, wr/inv ok
ppb4 at pci0 dev 28 function 3: vendor 0x8086 product 0x27d6 (rev. 0x02)
pci5 at ppb4 bus 12
pci5: i/o space, memory space enabled, rd/line, wr/inv ok
uhci0 at pci0 dev 29 function 0: vendor 0x8086 product 0x27c8 (rev. 0x02)
uhci0: interrupting at ioapic0 pin 16
usb0 at uhci0: USB revision 1.0
uhci1 at pci0 dev 29 function 1: vendor 0x8086 product 0x27c9 (rev. 0x02)
uhci1: interrupting at ioapic0 pin 17
usb1 at uhci1: USB revision 1.0
uhci2 at pci0 dev 29 function 2: vendor 0x8086 product 0x27ca (rev. 0x02)
uhci2: interrupting at ioapic0 pin 18
usb2 at uhci2: USB revision 1.0
uhci3 at pci0 dev 29 function 3: vendor 0x8086 product 0x27cb (rev. 0x02)
uhci3: interrupting at ioapic0 pin 19
usb3 at uhci3: USB revision 1.0
ehci0 at pci0 dev 29 function 7: vendor 0x8086 product 0x27cc (rev. 0x02)
ehci0: interrupting at ioapic0 pin 19
ehci0: EHCI version 1.0
ehci0: companion controllers, 2 ports each: uhci0 uhci1 uhci2 uhci3
usb4 at ehci0: USB revision 2.0
ppb5 at pci0 dev 30 function 0: vendor 0x8086 product 0x2448 (rev. 0xe2)
pci6 at ppb5 bus 21
pci6: i/o space enabled
cbb0 at pci6 dev 0 function 0: vendor 0x104c product 0x8039 (rev. 0x00)
cbb0: can't map socket base address 0xe4300000
cbb0: can't map socket base address 0xcb53fdf4: io mode
vendor 0x104c product 0x803a (Firewire serial bus, interface 0x10) at pci6 dev 
0 function 1 not configured
cbb0: cacheline 0x8 lattimer 0xa8
cbb0: bhlc 0x82a808
cbb0: interrupting at ioapic0 pin 16
cardslot0 at cbb0
cardbus0 at cardslot0: bus 22
pcmcia0 at cardslot0
ichlpcib0 at pci0 dev 31 function 0
ichlpcib0: vendor 0x8086 product 0x27b9 (rev. 0x02)
timecounter: Timecounter "ichlpcib0" frequency 3579545 Hz quality 1000
ichlpcib0: 24-bit timer
ichlpcib0: TCO (watchdog) timer configured.
piixide0 at pci0 dev 31 function 1
piixide0: Intel 82801GB/GR IDE Controller (ICH7) (rev. 0x02)
piixide0: bus-master DMA support present
piixide0: primary channel configured to compatibility mode
piixide0: primary channel interrupting at ioapic0 pin 14
atabus0 at piixide0 channel 0
piixide0: secondary channel configured to compatibility mode
piixide0: secondary channel ignored (disabled)
ahcisata0 at pci0 dev 31 function 2: vendor 0x8086 product 0x27c5
ahcisata0: interrupting at ioapic0 pin 16
ahcisata0: AHCI revision 1.1, 4 ports, 32 command slots, features 0xc710e000
atabus1 at ahcisata0 channel 0
ichsmb0 at pci0 dev 31 function 3: vendor 0x8086 product 0x27da (rev. 0x02)
ichsmb0: interrupting at ioapic0 pin 23
iic0 at ichsmb0: I2C bus
isa0 at ichlpcib0
aps0 at isa0 port 0x1600-0x161e
aps0: Thinkpad Active Protection System
timecounter: Timecounter "clockinterrupt" frequency 100 Hz quality 0
timecounter: Timecounter "TSC" frequency 1828932270 Hz quality 3000
azalia0: codec[0]: Analog Devices AD1981HD (rev. 2.0), HDA rev. 1.0
azalia0: codec[1]: 0x14f1/0x2bfa (rev. 0.0), HDA rev. 0.9
azalia0: codec[1]: No support for modem function groups
azalia0: codec[1] has no audio function groups
audio0 at azalia0: full duplex, independent
atapibus0 at atabus0: 2 targets
uhub0 at usb0: vendor 0x8086 UHCI root hub, class 9/0, rev 1.00/1.00, addr 1
uhub0: 2 ports with 2 removable, self powered
uhub1 at usb1: vendor 0x8086 UHCI root hub, class 9/0, rev 1.00/1.00, addr 1
uhub1: 2 ports with 2 removable, self powered
uhub2 at usb2: vendor 0x8086 UHCI root hub, class 9/0, rev 1.00/1.00, addr 1
uhub2: 2 ports with 2 removable, self powered
uhub3 at usb3: vendor 0x8086 UHCI root hub, class 9/0, rev 1.00/1.00, addr 1
uhub3: 2 ports with 2 removable, self powered
uhub4 at usb4: vendor 0x8086 EHCI root hub, class 9/0, rev 2.00/1.00, addr 1
uhub4: 8 ports with 8 removable, self powered
cd0 at atapibus0 drive 0: <HL-DT-ST DVDRAM GMA-4082N, M0072835043, CX08> cdrom 
removable
cd0: 32-bit data port
cd0: drive supports PIO mode 4, DMA mode 2, Ultra-DMA mode 2 (Ultra/33)
cd0(piixide0:0:0): using PIO mode 4, Ultra-DMA mode 2 (Ultra/33) (using DMA)
ahcisata0 port 0: device present, speed: 1.5Gb/s
wd0 at atabus1 drive 0: <TOSHIBA MK1234GSX>
wd0: drive supports 16-sector PIO transfers, LBA48 addressing
wd0: 111 GB, 232581 cyl, 16 head, 63 sec, 512 bytes/sect x 234441648 sectors
wd0: drive supports PIO mode 4, DMA mode 2, Ultra-DMA mode 5 (Ultra/100)
wd0(ahcisata0:0:0): using PIO mode 4, DMA mode 2, Ultra-DMA mode 5 (Ultra/100) 
(using DMA)
Kernelized RAIDframe activated
pad0: outputs: 44100Hz, 16-bit, stereo
audio1 at pad0: half duplex
acpiacad0: AC adapter online.
boot device: wd0
root on wd0a dumps on wd0b
root file system type: ffs
uhidev0 at uhub2 port 1 configuration 1 interface 0
uhidev0: Microsoft Microsoft 5-Button Mouse with IntelliEye(TM), rev 1.10/3.00, 
addr 2, iclass 3/1
ums0 at uhidev0: 5 buttons and Z dir.
wsmouse1 at ums0 mux 0
ugen0 at uhub3 port 2
ugen0: STMicroelectronics Biometric Coprocessor, rev 1.00/0.01, addr 2
wsdisplay0: screen 1 added (80x25, vt100 emulation)
wsdisplay0: screen 2 added (80x25, vt100 emulation)
wsdisplay0: screen 3 added (80x25, vt100 emulation)
wsdisplay0: screen 4 added (80x25, vt100 emulation)
--- END OF DMESG ---
>How-To-Repeat:
growisofs -Z /dev/rcd0d=image.iso
>Fix: