kern/46284: netbsd-6 panic: uarea_system_poolpage_free: failed to free uarea

[Matthew Mondor <mm_lists%pulsar-zone.net@localhost>]

>Number:         46284
>Category:       kern
>Synopsis:       netbsd-6 panic: uarea_system_poolpage_free: failed to free 
>uarea
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Fri Mar 30 22:50:01 +0000 2012
>Originator:     Matthew Mondor
>Release:        NetBSD 6.0_BETA
>Organization:
>Environment:
System: NetBSD ninja.xisop 6.0_BETA NetBSD 6.0_BETA (GENERIC_MM) #5: Mon Mar 26 
12:50:06 EDT 2012 root@ninja.xisop:/usr/obj/sys/arch/amd64/compile/GENERIC_MM 
amd64
Architecture: x86_64
Machine: amd64
>Description:

When playing a 2h movie from a DVD using rump_cd9660, the system locked
with the sound DMA buffer replaying endlessly in a loop, and I assumed
it was a panic.  Strangely, my ddb command on enter still didn't work
(call ddb_vgapost) but typing that manually worked, so I could get a
backtrace (manually copied):

breakpoint()
wskbd_translate()
wskbd_cngetc()
db_readline()
db_read_line()
db_command_loop()
db_trap()
kbd_trap()
--- trap (number 1) ---
breakpoint()
vpanic()
printf_nolog()
uarea_system_poolpage_alloc()
pr_pagelist_free()
pool_reclaim()
pool_drain_end()
uvm_pageout()

in dmesg:

panic: uarea_system_poolpage_free: failed to free uarea 0xffff800090bc0000

The trap number 1 and related backtrace above might be due to the
various keys I typed before being able to type "call vga_post" in the
debugger and have it work...

Interestingly, I experience less crashes than before when using
rump_cd9660.  But a number of other bugs have also been fixed since I
started using it on netbsd-6.

>How-To-Repeat:
>Fix: