kern/176510: Kernel Panic in udp_input @ offset 0x475

[Asa Yeamans]

>Number:         176510
>Category:       kern
>Synopsis:       Kernel Panic in udp_input @ offset 0x475
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Thu Feb 28 15:30:00 UTC 2013
>Closed-Date:
>Last-Modified:
>Originator:     Asa Yeamans
>Release:        9.1
>Organization:
Texas State University
>Environment:
FreeBSD theonering 9.1-RELEASE FreeBSD 9.1-RELEASE #0 r243825: Tue Dec  4 09:23:10 UTC 2012     root at farrell.cse.buffalo.edu:/usr/obj/usr/src/sys/GENERIC  amd64

>Description:
FreeBSD 9.1 Release is kernel panicing very frequently on our network on (so far) one of our servers. In a 10 hour period it has occurred 14 times. In all cases the stack trace of the core dump is identical (or very near) indicating that all kernel panics are caused by the same underlying cause. Below is the common portion of the stack trace.
KDB: stack backtrace:
#0 0xffffffff809208a6 at kdb_backtrace+0x66
#1 0xffffffff808ea8be at panic+0x1ce
#2 0xffffffff80bd8240 at trap_fatal+0x290
#3 0xffffffff80bd857d at trap_pfault+0x1ed
#4 0xffffffff80bd8b9e at trap+0x3ce
#5 0xffffffff80bc315f at calltrap+0x8
#6 0xffffffff80a861d5 at udp_input+0x475
#7 0xffffffff80a043dc at ip_input+0xac
#8 0xffffffff809adafb at netisr_dispatch_src+0x20b
#9 0xffffffff809a35cd at ether_demux+0x14d
#10 0xffffffff809a38a4 at ether_nh_input+0x1f4
#11 0xffffffff809adafb at netisr_dispatch_src+0x20b

Inside this server there are two onboard nics of the "bce" type and 4 PCI nics of the "em" type. 

I have 16 core dump's and associated files with this identical crash comprising 16+ GB of data. I do not have a patch file at this time, but I am happy to try them out.
>How-To-Repeat:
Plug into our network. It happens on average every 45 minutes from, I'm guessing, a specific UDP packet that causes the udp_input to die.
>Fix:
Unknown

>Release-Note:
>Audit-Trail:
>Unformatted: