kern/40530: panic: kmem_poison_check

[spz%NetBSD.org@localhost]

>Number:         40530
>Category:       kern
>Synopsis:       panic: kmem_poison_check
>Confidential:   no
>Severity:       serious
>Priority:       high
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sun Feb 01 11:05:00 +0000 2009
>Originator:     S.P.Zeidler
>Release:        NetBSD 5.0_RC1 20090130 ~ 10:00 UTC
>Organization:
        TNF
>Environment:
System: NetBSD babylon5.netbsd.org 5.0_RC1 NetBSD 5.0_RC1 (NBFTP) #3: Fri Jan 
30 11:16:37 UTC 2009 
spz@ADMIN:/chroots/netbsd-5/src/sys/arch/amd64/compile/obj/NBFTP amd64
Architecture: x86_64
Machine: amd64

>Description:
panic: kmem_poison_check: 0xffff800043a2bb20: 0x07 != 0xae

fatal breakpoint trap in supervisor mode
trap type 1 code 0 rip ffffffff804054a5 cs 8 rflags 246 cr2  7f7ffd5a4c90 cpl 0 
rsp ffff800039be2820
Stopped in pid 21559.1 (ftp) at netbsd:breakpoint+0x5:  leave
db{0}> bt
breakpoint() at netbsd:breakpoint+0x5
cpu_Debugger() at netbsd:cpu_Debugger+0x9
panic() at netbsd:panic+0x260
kmem_poison_check() at netbsd:kmem_poison_check+0x82
kmem_alloc() at netbsd:kmem_alloc+0x58
kmem_zalloc() at netbsd:kmem_zalloc+0x19
ufs_balloc_range() at netbsd:ufs_balloc_range+0xbb
ffs_write() at netbsd:ffs_write+0x661
VOP_WRITE() at netbsd:VOP_WRITE+0x66
vn_write() at netbsd:vn_write+0xce
dofilewrite() at netbsd:dofilewrite+0x81
sys_write() at netbsd:sys_write+0x72
syscall() at netbsd:syscall+0xa0
db{0}> sh reg
ds          0x27f0
es          0x3
fs          0x8
gs          0x58ae
rdi         0
rsi         0x3f8
rbp         0xffff800039be2820
rbx         0xffff800039be2840
rdx         0x8
rcx         0
rax         0x1
r8          0xffffffff806bc8ea  copyright+0x7e0aa
r9          0x1
r10         0xffff800039be2750
r11         0x8
r12         0x100
r13         0xffffffff80675ca2  copyright+0x37462
r14         0x120000
r15         0x127dc4
rip         0xffffffff804054a5  breakpoint+0x5
cs          0x8
rflags      0x246
rsp         0xffff800039be2820
ss          0x10
netbsd:breakpoint+0x5:  leave
db{0}> mach cpu 1
using CPU 1
db{0}> bt
callout_active() at netbsd:callout_active+0x46
tcp_output() at netbsd:tcp_output+0x228d
tcp_usrreq() at netbsd:tcp_usrreq+0x1e2
tcp_usrreq_wrapper() at netbsd:tcp_usrreq_wrapper+0x51
sosend() at netbsd:sosend+0x506
soo_write() at netbsd:soo_write+0x2d
dofilewrite() at netbsd:dofilewrite+0x81
sys_write() at netbsd:sys_write+0x72
syscall() at netbsd:syscall+0xa0
db{0}> sh reg
ds          0
es          0
fs          0
gs          0
rdi         0x4
rsi         0xe0000000
rbp         0xffff8000415a8890
rbx         0xffffffff808e6280  callout_cpu0
rdx         0x8e0
rcx         0x7
rax         0x1
r8          0xffff80000f9f4000
r9          0x10
r10         0x4
r11         0x4
r12         0xffff800017bedc01
r13         0xffff800017bedc80
r14         0
r15         0x10
rip         0xffffffff80348166  callout_active+0x46
cs          0x8
rflags      0x246
rsp         0xffff8000415a8880
ss          0x10
netbsd:callout_active+0x46:     movzbl  %r12d,%eax

a crashdump and a netbsd.gdb are available
>How-To-Repeat:
>Fix: