netbsd-5/i386 panic report w/ 'invalid address'

["Brian A. Seklecki" <seklecki%noc.cfi.pgh.pa.us@localhost>]

All:

A pf(4) box running NetBSD 5.0_STABLE from August crashed this AM.

Unfortunately:

1) My console server doesn't have scrollback
2) The kernel is customized for an embedded platform, so no dump 
   device or backtrace:

db{0}> 
db{0}> bt
Xsoftintr() at netbsd:Xsoftintr+0x34
--- interrupt ---
fatal page fault in supervisor mode
trap type 6 code 0 eip c0477b58 cs 8 eflags 14046 cr2 f689c3c9 ilevel 8
kernel: supervisor trap page fault, code=0

Faulted in DDB; continuing...

fatal page fault in supervisor mode
trap type 6 code 0 eip f1e2866 cs 8 eflags 10296 cr2 f1e2866 ilevel 8
kernel: supervisor trap page fault, code=0
Stopped in pid 0.6 (system) at  0xf1e2866:      invalid address
db{0}> 

There's a lot of talk about "pid 0.6 (system)" but not in combination
with "invalid address".

I'll entertain bad RAM as a possibility; these embedded systems don't
exactly have fully-buffered ECC w/ RAID pairs.

This kernel has:

  #options        DEBUG           # expensive debugging checks/support 
  options         DDB             # in-kernel debugger
  #options        KGDB            # remote debugger

~BAS