What you see is described in PR 24126 - it is a pretty old pmap problem that
used to be hard to reproduce. Now some MI changes in -current seem to have
made it happen *much* more frequently.

The current theory is that an anon references a already freed pmap. Sometimes
the pseg entries are 0 (which cause the "pseg empty!" panics), but sometimes
they are just random other garbage - making pseg_get or pseg_set crash on
alignement or access faults.

We are investigating this, and it should be a lot easier to fix now that it
happens often.

Martin