Kernel panic when copying data to umass device (USB4BSD)

[Jeremy Chadwick]

Not sure if this is caused by problems with USB4BSD or not, as I can
reproduce it on RELENG_7 (but there, the kernel does not panic; it just
"wedges" in a loop/thread somewhere; SSH sessions remain up, but
commands running stop; hitting Ctrl-T shows them in all sorts of
different states, but the states never change; hitting Ctrl-Alt-Esc does
in fact drop me to db>).

Anyway, WRT CURRENT, here's the scenario:

- Insert Sandisk U3 Cruzer (8GB) USB flash drive

ugen4.2: <SanDisk> at usbus4
umass0: <SanDisk product 0x5406, class 0/0, rev 2.00/2.00, addr 2> on usbus4
umass0:  SCSI over Bulk-Only; quirks = 0x0000
umass0:0:0:-1: Attached to scbus0
da0 at umass-sim0 bus 0 target 0 lun 0
da0: <SanDisk Cruzer 7.01> Removable Direct Access SCSI-0 device
da0: 40.000MB/s transfers
da0: 7663MB (15695871 512 byte sectors: 255H 63S/T 977C)

/storage is a ZFS pool
/dev/da0s1a is a UFS1 filesystem (e.g. newfs -O1 /dev/da0s1a)

# mdconfig -a -t vnode -u 0 -f /storage/7.1-BETA2-amd64-disc1.iso
# mdconfig -a -t vnode -u 1 -f /storage/7.1-BETA2-i386-disc1.iso
# mount /dev/md0 /iso0
# mount /dev/md1 /iso1
# mount /dev/da0s1a /mnt
# cp -vpR /iso0/* /mnt

The system will eventually kernel panic in the middle of this copy.  I'm
unable to obtain a crash dump; doing "panic" at the db> prompt causes
the same trace to happen over and over, so I've taken a photo of the
console.  Kernel has KBD_TRACE set, hence the auto-backtrace:

http://www.malkavian.com/~jdc/usb2_da0_crash.jpg

-- 
| Jeremy Chadwick                                jdc at parodius.com |
| Parodius Networking                       http://www.parodius.com/ |
| UNIX Systems Administrator                  Mountain View, CA, USA |
| Making life hard for others since 1977.              PGP: 4BD6C0CB |