kern/50139: Install on KVM/amd64 with cpus>1 results in kernel panic: ffs_valloc: dup alloc

[edwin%etorok.net@localhost]

>Number:         50139
>Category:       kern
>Synopsis:       Install on KVM/amd64 with cpus>1 results in kernel panic: ffs_valloc: dup alloc
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sun Aug 09 17:10:03 +0000 2015
>Originator:     Török Edwin
>Release:        6.1.5
>Organization:
Skylable Ltd.
>Environment:
Linux debian 4.1.0-1-amd64 #1 SMP Debian 4.1.3-1 (2015-08-03) x86_64 GNU/Linux
>Description:
During installation of NetBSD-6.1.5/amd64 and NetBSD-7.0-RC2/amd64 
on KVM/virtio I get a kernel panic every time:

mode 816d mode 816d dgen 797498f0 gen 797498f0
size 1c3ea blocks e4
ino 833732 ipref 829441
panic: ffs_valloc: dup alloc
fatal breakpoint trap in supervisor mode
trap type 1 code 0 rip ffffffff80281d1d cs 8 rflags 246 cr2 ffff800049c60000 ilevel 0 rsp fffffe804101ca68
curlwp 0xffffffe813eab12a0 pid 114.1 lowest kstack 0xfffffe804101a2c0
Stopped in pid 114.1 (tar) at netbsd:breakpoint+0x5: leave
db{0}>

Here are screenshots and a DDB backtrace from 6.1.5:
https://imgy.org/753YQL3X
https://imgy.org/zX2AKMow
And here is another panic from 7.0-RC2: https://imgy.org/1qJxwmo9


The host CPU is: AMD FX(tm)-8350 Eight-Core Processor
virt-manager version: 1.0.1
host QEMU: version 2.1.2 (Debian 1:2.1+dfsg-12+deb8u1)
Host kernel: Linux debian 4.1.0-1-amd64 #1 SMP Debian 4.1.3-1 (2015-08-03) x86_64 GNU/Linux


>How-To-Repeat:
Start virt-manager on Debian Jessie, choose to use a local ISO with NetBSD-6.1.5 amd64, select 'FreeBSD 10.x or later' as the OS type (otherwise you get some ACPI related panics).
Allocate the default (8 GiB) disk space, 4 GiB of memory, and 4 CPUs.
Start the installation and accept the defaults where possible (use full disk, default partition sizes, install sets from CD).
When the installer extracts the sets the kernel panics. Not always on the same set, but definetely during the extraction of the sets.

The problem also reproduces with 2 GiB of memory and 2 CPUs, and with NetBSD-7.0-RC2/amd64 too.

>Fix:
As a workaround I have set the number of cpus to 1, and the installation of NetBSD-6.1.5 has finished successfully.