I'd be willing to bet that it's a problem in the file handling in the
kernel.  You mentioned a panic (closef, ref count < 0).  0xdeadbeef as a
signed 32-bit int is less than 0, as are 0xbeef (16b) and 0xef (8b).

Probably somebody holds onto a reference to the structure, it gets
freed, and then they pass it around, incrementing a reference count.

Happy hunting!
-- 
==John Kohl <jtk@kolvir.arlington.ma.us>, <john_kohl@alum.mit.edu>
Home page: <http://people.ne.mediaone.net/jtk/>
Bicycling and Skiing to keep fit.