I can fairly reliably crash my 1.5L machine with Netscape 4.76.
Clicking "get mail" in Netscape Messenger will trigger it.  It
doesn't happen everytime, but often enough to be repeatable.
(e.g. it did it twice yesterday, once so far this morning)
My kernel is from November 29 source.  I'll update it to the
latest source available via rsync, and test it again.

I have a kernel built with -g, and the core if anyone wants it.
If I can't find a similar PR, I'll send-pr it this afternoon.

Meanwhile, here is the traceback from gdb.

Thanks for insight.=20

-Andrew


(gdb) target kcore /var/crash/netbsd.1.core
panic: %s: direct pointer #%d mismatch %d !=3D %d
#0  cpu_reboot (howto=3D11, bootstr=3D0xc6da3a70 "\030;=DA=C6=D8=AA\030=C0\=
001")
    at ../../../../arch/i386/i386/machdep.c:1348
1348    {
(gdb) where
#0  cpu_reboot (howto=3D11, bootstr=3D0xc6da3a70 "\030;=DA=C6=D8=AA\030=C0\=
001")
    at ../../../../arch/i386/i386/machdep.c:1348
#1  0xc02f3e87 in cpu_reboot (howto=3D260, bootstr=3D0x0)
    at ../../../../arch/i386/i386/machdep.c:1371
#2  0xc018adc1 in db_fncall (addr=3D1, have_addr=3D0, count=3D-1069998919,
    modif=3D0xc6da3aa0 "=C0dT=C0\001") at ../../../../ddb/db_command.c:652
#3  0xc018aad8 in db_command (last_cmdp=3D0xc04f13e8, cmd_table=3D0xc04f120=
8)
    at ../../../../ddb/db_command.c:319
#4  0xc018ac9e in db_command_loop () at ../../../../ddb/db_command.c:577
#5  0xc018dc5e in db_trap (type=3D1, code=3D0) at ../../../../ddb/db_trap.c=
:86
#6  0xc02f16a2 in kdb_trap (type=3D1, code=3D0, regs=3D0xc6da3bcc)
    at ../../../../arch/i386/i386/db_interface.c:119
#7  0xc02fbf8c in trap (frame=3D{tf_es =3D -958791664, tf_ds =3D 892665872,
      tf_edi =3D 256, tf_esi =3D -1069359904, tf_ebp =3D -958776316,
      tf_ebx =3D -958776284, tf_edx =3D -1065385984, tf_ecx =3D 1792, tf_ea=
x =3D 0,
      tf_trapno =3D 1, tf_err =3D 0, tf_eip =3D -1070655652, tf_cs =3D 8,
      tf_eflags =3D 514, tf_esp =3D -958776296, tf_ss =3D -1071952160,
      tf_vm86_es =3D 955200, tf_vm86_ds =3D -1065205696, tf_vm86_fs =3D -10=
27223000,
      tf_vm86_gs =3D -958776212}) at ../../../../arch/i386/i386/trap.c:281
#8  0xc0100e79 in calltrap ()
#9  0xc01b4ee0 in panic (
    fmt=3D0xc042dce0 "%s: direct pointer #%d mismatch %d !=3D %d")
    at ../../../../kern/subr_prf.c:224
---Type <return> to continue, or q <return> to quit---
#10 0xc02c6161 in initiate_write_inodeblock (inodedep=3D0xc085ef00,
    bp=3D0xc27b9868) at ../../../../ufs/ffs/ffs_softdep.c:3018
#11 0xc02c5e8b in softdep_disk_io_initiation (bp=3D0xc27b9868)
    at ../../../../ufs/ffs/ffs_softdep.c:2856
#12 0xc01df95a in spec_strategy (v=3D0xc6da3cb4)
    at ../../../../miscfs/specfs/spec_vnops.c:512
#13 0xc01c8e39 in bwrite (bp=3D0xc27b9868) at ../../../../sys/vnode_if.h:16=
54
#14 0xc02c1d78 in ffs_update (v=3D0xc6da3d7c)
    at ../../../../ufs/ffs/ffs_inode.c:145
#15 0xc02c255f in ffs_truncate (v=3D0xc6da3e68)
    at ../../../../sys/vnode_if.h:1452
#16 0xc02db860 in ufs_setattr (v=3D0xc6da3ea4) at ../../../../sys/vnode_if.=
h:1419
#17 0xc01d3c6d in sys_ftruncate (p=3D0xc6d9b33c, v=3D0xc6da3f30, retval=3D0=
xc6da3f80)
    at ../../../../sys/vnode_if.h:320
#18 0xc03f14b3 in compat_43_sys_ftruncate (p=3D0xc6d9b33c, v=3D0xc6da3f88,
    retval=3D0xc6da3f80) at ../../../../../../compat/common/vfs_syscalls_43=
.c:272
#19 0xc02fc6a4 in syscall (frame=3D{tf_es =3D 31, tf_ds =3D -1078001633,
      tf_edi =3D 24104, tf_esi =3D 151927936, tf_ebp =3D -1077952196, tf_eb=
x =3D 17,
      tf_edx =3D 24104, tf_ecx =3D 24104, tf_eax =3D 93, tf_trapno =3D 3, t=
f_err =3D 2,
      tf_eip =3D 1222452721, tf_cs =3D 23, tf_eflags =3D 642, tf_esp =3D -1=
077952212,
      tf_ss =3D 31, tf_vm86_es =3D 0, tf_vm86_ds =3D 0, tf_vm86_fs =3D 0,
      tf_vm86_gs =3D 0}) at ../../../../arch/i386/i386/trap.c:734
#20 0xc0100f31 in syscall1 ()
can not access 0xbfbfc13c, invalid translation (invalid PDE)
can not access 0xbfbfc13c, invalid translation (invalid PDE)
---Type <return> to continue, or q <return> to quit---
Cannot access memory at address 0xbfbfc13c.