hi,

> > I think obj on NFS is necessary to trip the problem; the faulting 
> > address on my system is within the pager_map address range, and pageout 
> > to FFS vs NFS have definitely behaved differently in the past :-)
> 
> Hm, this reminds me recent nfs_vnops change; nfs_writerpc is changed
> to avoid data copy if possible, and mbuf refers the mapped page
> directly in the case.  If such mbuf (or shared ext. reference?)
> survives after biodone, similar fault may occur.

yes, it seem to be my bug.
i've fixed this in nfs_vnops.c rev.1.171.
sorry for the mess.

YAMAMOTO Takashi