kern/45013: assertion failure in ucomstart in ucom.c with a two CDC ACM devices

[jasper%pointless.net@localhost]

>Number:         45013
>Category:       kern
>Synopsis:       assertion failure in ucomstart in ucom.c  with a two CDC ACM 
>devices
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Wed Jun 01 04:25:00 +0000 2011
>Originator:     Jasper Wallace
>Release:        5.99.49
>Organization:
Pointless.net
>Environment:
NetBSD monstrosity 5.99.49 NetBSD 5.99.49 (MONSTROSITY) #0: Fri Apr 22 10:52:22 
BST 2011  jasper@monstrosity:/usr/build/obj/sys/arch/amd64/compile/MONSTROSITY 
amd64
>Description:
With a Simtec Entropy key (http://www.entropykey.co.uk/), which attaches as a 
umodem/ucom device:

umodem0 at uhub1 port 2 configuration 1 interface 0
umodem0: Simtec Electronics Entropy Key, rev 2.00/2.00, addr 2, iclass 2/2
umodem0: data interface 1, has no CM over data, has no break
umodem0: status change notification available
ucom0 at umodem0

or with an MTK GPS:

umodem1 at uhub1 port 1 configuration 1 interface 1
umodem1: MTK GPS Receiver, rev 2.00/1.00, addr 3, iclass 2/2
umodem1: data interface 0, has no CM over data, has no break
umodem1: status change notification available
ucom1 at umodem1

running 'echo Hello > /dev/ttyU0' hangs the echo, and then hitting Ctrl-C 
panics the kernel with:

panic: kernel diagnostic assertion "ub != NULL" failed: file
"/usr/src/sys/dev/usb/ucom.c", line 1009
fatal breakpoint trap in supervisor mode
trap type 1 code 0 rip ffffffff8016d2dd cs 8 rflags 246 cr2  7f7ff7b196c0
cpl 8 rsp ffff8000534aaa50
Stopped in pid 0.3 (system) at  netbsd:breakpoint+0x5:  leave

backtrace:

breakpoint() at netbsd:breakpoint+0x5
panic() at netbsd:panic+0x2b7
kern_assert() at netbsd:kern_assert+0x2d
ucomstart() at netbsd:ucomstart+0x1a9
ttstart() at netbsd:ttstart+0x12
ttyinput() at netbsd:ttyinput+0x36
ucom_read_complete() at netbsd:ucom_read_complete+0x74
ucomreadcb() at netbsd:ucomreadcb+0x163
usb_transfer_complete() at netbsd:usb_transfer_complete+0x244
ohci_softintr() at netbsd:ohci_softintr+0x624
softint_dispatch() at netbsd:softint_dispatch+0xd0
DDB lost frame for netbsd:Xsoftintr+0x4f, trying 0xffff8000534aad70
Xsoftintr() at netbsd:Xsoftintr+0x4f



>How-To-Repeat:
Insert ucom device, run 'echo Hello > /dev/ttyUX', hit Ctrl-C

>Fix:
not sure.

possibly related to the problem and fix in rev 1.86 of ucom.c?

both devices constantly spits status info out, so maybe the problem occurs if 
the device has data waiting, but the opener of the dev node is only writing?