kern/41400: uhci_poll_hub "c->c_magic == CALLOUT_MAGIC" assertion failure

[yamt%mwd.biglobe.ne.jp@localhost]

>Number:         41400
>Category:       kern
>Synopsis:       uhci_poll_hub "c->c_magic == CALLOUT_MAGIC" assertion failure
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sun May 10 08:00:01 +0000 2009
>Originator:     YAMAMOTO Takashi <yamt%mwd.biglobe.ne.jp@localhost>
>Release:        NetBSD 5.99.11 (see below)
>Organization:

>Environment:
System: NetBSD kaeru 5.99.11
Architecture: i386
Machine: i386
>Description:
        i got the following during shutdown.
        the kernel was with yamt-nfs-mp branch.
        its uhci.c is identical with rev.1.228.

scsibus1: detached
scsibus0: detached
cd0: detached
pci5: detached
pci2: detached
atapibus0: detached
wd0: detached
ppb4: detached
ppb1: detached
atabus1: detached
atabus0: detached
uhub2: at usb2 (addr 1) disconnected
uhub2: detached
usb2: detached
uhub0: at usb1 (addr 1) disconnected
uhub0: detached
usb1: detached
uhub1: at usb0 (addr 1) disconnected
uhub1: detached
panic: kernel diagnostic assertion "c->c_magic == CALLOUT_MAGIC" failed: file 
"/siro/nbsd/nfs-mp/src/sys/kern/kern_timeout.c", line 384
fatal breakpoint trap in supervisor mode
trap type 1 code 0 eip c017bc24 cs 8 eflags 246 cr2 bb95c000 ilevel 2
Stopped in pid 0.5 (system) at  netbsd:breakpoint+0x4:  popl    %ebp
db{0}> t
breakpoint(c05808b2,d6f12c8c,c05a4cc0,c04ebea6,c061b640,c05e8300,d6f12c80,c05a4d
dc,1,c05e8300) at netbsd:breakpoint+0x4
panic(c059e120,c0540782,c0563b6a,c0563c54,180,d4f8e500,d6f12cd0,c02a5716,c054078
2,c0563c54) at netbsd:panic+0x1c9
__kernassert(c0540782,c0563c54,180,c0563b6a,c4cf5b00,c044c6d0,c04c21a0,c05aff20,
c05d9ae0,c4cf5b00) at netbsd:__kernassert+0x39
callout_reset(c05b0bc0,c04c21a0,c044c6d0,c4cf5b00,2,d4f8e500,0,d7388dd4,c05d9ae0
,0) at netbsd:callout_reset+0xc6
uhci_poll_hub(c4cf5b00,d4f8e500,7,d4f86f80,d6dfd074,c05d9b40,c05da348,c05dab48,c
05db348,c044c6d0) at netbsd:uhci_poll_hub+0x4c
callout_softclock(0,0,d9200030,d4f80010,d4f80010,0,4bf020,d98d79bc,30,d6f10010) 
a
t netbsd:callout_softclock+0x368
softint_dispatch(d4f8ec80,2,0,0,0,0,d6f12d90,d6f12c64,d702099c,0) at netbsd:soft
int_dispatch+0xcd
DDB lost frame for netbsd:Xsoftintr+0x3d, trying 0xd6f12d88
Xsoftintr() at netbsd:Xsoftintr+0x3d
fatal page fault in supervisor mode
trap type 6 code 0 eip c01881e0 cs 8 eflags 10246 cr2 0 ilevel 8
kernel: supervisor trap page fault, code=0
Faulted in DDB; continuing...
db{0}> x/x c05b0bc0
netbsd:wsdisplay_noemul_ca+0x20:        0
db{0}> 
>How-To-Repeat:
        
>Fix:
        

>Unformatted: