port-amd64/55816: mdopen() kills the kernel

[martin%NetBSD.org@localhost]

>Number:         55816
>Category:       port-amd64
>Synopsis:       mdopen() kills the kernel
>Confidential:   no
>Severity:       critical
>Priority:       high
>Responsible:    port-amd64-maintainer
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sun Nov 22 13:35:00 +0000 2020
>Originator:     Martin Husemann
>Release:        NetBSD 9.99.75
>Organization:
The NetBSD Foundation, Inc.
>Environment:
System: NetBSD seven-days-to-the-wolves.aprisoft.de 9.99.75 NetBSD 9.99.75 (GENERIC) #425: Wed Nov 4 15:34:33 CET 2020 martin%seven-days-to-the-wolves.aprisoft.de@localhost:/work/src/sys/arch/amd64/compile/GENERIC amd64
Architecture: x86_64
Machine: amd64
>Description:

I am trying to back up some old shark disk, connected via USB to a -current 
amd64 machine. I have the ffs on that disk mounted readonly on /targetroot.

Now when I do:

 # cd /targetroot && tar cvf - . | gzip -9 > $somewherelse

I get:

[..]
a ./dev/rsd0j
a ./dev/rsd0k
uvm_fault..
fatal page fault..
..
config_devalloc+0x178
config_attach_pseucdo+0x16
mdopen+0x15c
spec_open+0x176
VOP_OPEN+0x3c
vn_open+0x19d
do_open+0x119
do_sys_openat+0x74
...

where it dies on cmpq $0,0(%rcx,%rax,8)
with %rcx = 0 and %rax = ffffffffffff8000

(see also PR 55815, this of course is also a very stupid bug in tar)

>How-To-Repeat:
s/a
>Fix:
n/a