kern/52937: NetBSD 8.0_BETA panics in pmap_remove_pte

[alnsn%yandex.ru@localhost]

>Number:         52937
>Category:       kern
>Synopsis:       NetBSD 8.0_BETA panics in pmap_remove_pte
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sun Jan 21 10:00:01 +0000 2018
>Originator:     Alexander Nasonov
>Release:        NetBSD 8.0_BETA
>Organization:
XMM SWAP LTD
>Environment:
NetBSD ns3078965 8.0_BETA NetBSD 8.0_BETA (NOIPMI) #0: Sun Dec 17 22:39:04 GMT 2017  alnsn@nebeda:/home/alnsn/netbsd-8/src/sys/arch/amd64/compile/obj/NOIPMI amd64
>Description:
The kernel was compiled without ipmi as a workaround for this bug: 
pkg/52764 (NetBSD 8.0_BETA crashed - ipmi0: workqueue busy: updates stopped)

This time it crashed differently:

panic: pmap_remove_pte: PG_PVLIST with pv-untracked page va = 0x7f7eba200000 pa = 0xffe8dea6c0000 (0xffe8dea6c0)
cpu5: Begin traceback...
vpanic() at netbsd:vpanic+0x140
snprintf() at netbsd:snprintf
pmap_remove_pte() at netbsd:pmap_remove_pte+0x2e3
pmap_remove() at netbsd:pmap_remove+0x23d
uvm_unmap_remove() at netbsd:uvm_unmap_remove+0x207
uvmspace_free() at netbsd:uvmspace_free+0xe4
exit1() at netbsd:exit1+0x1a0
sigexit() at netbsd:sigexit+0x15a
sendsig() at netbsd:sendsig
lwp_userret() at netbsd:lwp_userret+0x1be
trap() at netbsd:trap+0x926
--- trap (number 6) ---
7f7eba200770
cpu5: End traceback...

dumping to dev 20,1 (offset=327, size=8272343):
dump device not ready


dmesg: https://www.netbsd.org/~alnsn/ovh-dmesg-netbsd8.out
>How-To-Repeat:
Not known.

The box had been running fine to several days. Eventually, it stopped accepting ssh connections over tor and panicked a couple of hours later. 
>Fix:
Not known.