kern/43240: KASSERT umap->refcount != 0 failed (sys/uvm/uvm_bio.c:248)

[njoly%pasteur.fr@localhost]

>Number:         43240
>Category:       kern
>Synopsis:       KASSERT umap->refcount != 0 failed (sys/uvm/uvm_bio.c:248)
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Mon May 03 13:50:00 +0000 2010
>Originator:     Nicolas Joly
>Release:        NetBSD 5.99.29
>Organization:
Institut Pasteur
>Environment:
System: NetBSD kiri-001.cluster.pasteur.fr 5.99.29 NetBSD 5.99.29 (KIRI001) #0: 
Mon May  3 12:10:56 CEST 2010  
njoly%lanfeust.sis.pasteur.fr@localhost:/local/src/NetBSD/obj.amd64/sys/arch/amd64/compile/KIRI001
 amd64
Architecture: x86_64
Machine: amd64
>Description:
While stress testing the network interfaces on a new -current
NetBSD/amd64 server which has 64GB of ram, the following KASSERT
fired:

panic: kernel diagnostic assertion "umap->refcount != 0" failed: file 
"/local/src/NetBSD/src/sys/uvm/uvm_bio.c", line 248
fatal breakpoint trap in supervisor mode
trap type 1 code 0 rip ffffffff80229d35 cs 8 rflags 246 cr2  ffff8000d1c27000 
cpl 0 rsp ffff8000d2ccb430
Stopped in pid 20774.1 (dd) at  netbsd:breakpoint+0x5:  leave
db{3}> bt
breakpoint() at netbsd:breakpoint+0x5
panic() at netbsd:panic+0x2ba
kern_assert() at netbsd:kern_assert+0x2d
ubc_fault() at netbsd:ubc_fault+0x4c9
uvm_fault_internal() at netbsd:uvm_fault_internal+0x469
trap() at netbsd:trap+0x702
--- trap (number 0) ---
0:

This is highly reproductible when running the following command from a
remote host (running Linux, but that should not matters ....) on the
same subnet.

  cat /dev/zero | rsh kiri-001.cluster.pasteur.fr dd of=/dev/null bs=2g

It does not panic for block size values below 2GB, or when running the
same commands locally `cat /dev/zero | dd of=/dev/null bs=2g' ...

Same result with both UP and SMP kernels.

>How-To-Repeat:
Run the previous command to a NetBSD amd64 host with a DIAGNOSTIC kernel.
>Fix: