Kernel crashes from rsh

[Peter Much]

Hi all, 

this is a 486 system running 4.7.0-RELEASE and my PPPoE-gateway 
to the internet.

It runs fine and stable all the time, except when I download
the filesystem-dumps to my other machine where the tape is 
attached. Then after an hour or two of downloading (slow old
tape) the kernel panics from rsh.

The kernel debugger then always shows the following stacktrace: 
m_copym, tcp_output, tcp_usr_send, sosend, soo_write, dofilewrite,
write, syscall2.

I tried to activate INVARIANTS to see what might go wrong in
m_copym(), but that doesnt work: the kernel would not even
boot, but panics when attaching the devices.

So I did activate INVARIANT_SUPPORT only, and defined INVARIANTS
only in kern/uipc_mbuf.c (where m_copym() dwells). Now again I
get the panics in the expected situation, beforehand there is
a message "panic: freeing free mbuf", but the stacktrace is
now totally different (and much longer), and the system cannot
write a dump: it waits a while, then reports that it cannot 
synchronize the cache, tries to dump, then reports i/o error.

I have currently no clue on how to investigate further. Ideas
are welcome. 

rgds,
Peter