port-i386/40143: Crash in i386:doreti_checkast()

[scw%netbsd.org@localhost]

>Number:         40143
>Category:       port-i386
>Synopsis:       Viewing an mpeg transport stream with mplayer causes crash
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    port-i386-maintainer
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Tue Dec 09 13:35:00 +0000 2008
>Originator:     Steve Woodford
>Release:        NetBSD 5.0_BETA
>Organization:
>Environment:
System: NetBSD joe.mctavish.co.uk 5.0_BETA NetBSD 5.0_BETA (JOE) #0: Tue Dec 9 
12:43:27 GMT 2008 
steve%mctavish.co.uk@localhost:/usr/src/sys/arch/i386/compile/JOE i386
Architecture: i386
Machine: i386
>Description:
I have a DVB-T card installed in an Ubuntu box which I use for occasional
streaming of broadcast video to my NetBSD workstation. The stream is
viewed using mplayer on NetBSD.

I last used this set up some time before the netbsd-5 branch was cut and
it worked well. Now, however, shortly after starting mplayer the NetBSD
box panics. Due to having no desire to deliberately crash my NetBSD
workstation (raid parity rebuild takes forever), I've only tried to
reproduce this problem twice. On both occasions the panic occurred within
a few minutes of starting mplayer.

The NetBSD box is running 5.0_BETA from this morning (2008/12/9), but
without DDB. Best I can do at the moment is fish the panic string ouf of
the crash dump, provide a basic gdb backtrace, and disassembly of
doreti_checkast():

fatal protection fault in supervisor mode
trap type 4 code 8c eip c0100d69 cs 8 eflags 210046 cr2 d53bc000 ilevel 0

#0  0xc03273f2 in cpu_reboot ()
#1  0xc02aa999 in panic ()
#2  0xc0329dfa in trap ()
#3  0xc010ca8f in calltrap ()
#4  0xc0100d69 in doreti_checkast ()
[gdb refuses to trace further back than here]

c0100d33 <doreti_checkast>:
c0100d33:       64 a1 18 00 00 00       mov    %fs:0x18,%eax
c0100d39:       83 78 24 00             cmpl   $0x0,0x24(%eax)
c0100d3d:       74 1c                   je     c0100d5b <doreti_checkast+0x28>
c0100d3f:       c7 40 24 00 00 00 00    movl   $0x0,0x24(%eax)
c0100d46:       fb                      sti
c0100d47:       c7 44 24 2c 03 00 00    movl   $0x3,0x2c(%esp)
c0100d4e:       00
c0100d4f:       54                      push   %esp
c0100d50:       e8 02 8e 22 00          call   c0329b57 <trap>
c0100d55:       83 c4 04                add    $0x4,%esp
c0100d58:       fa                      cli
c0100d59:       eb c3                   jmp    c0100d1e <Xdoreti+0x3e>
c0100d5b:       64 83 3d 54 01 00 00    cmpl   $0x0,%fs:0x154
c0100d62:       00
c0100d63:       75 30                   jne    c0100d95 <doreti_checkast+0x62>
c0100d65:       8e 6c 24 00             movl   0x0(%esp),%gs
c0100d69: ***** 8e 64 24 04             movl   0x4(%esp),%fs
c0100d6d:       8e 44 24 08             movl   0x8(%esp),%es
c0100d71:       8e 5c 24 0c             movl   0xc(%esp),%ds

Crash dump (30MB), kernel binary, dmesg, and config file available on request.
>How-To-Repeat:
Attempt to view a DVB-T mpeg transport stream (streamed over http) using
mplayer on 5.0_BETA.
>Fix:
Unknown.