panic: ffs_blkfree: freeing free block

[Rong-En Fan]

Hi,

I have seen this knid of panic on 5.3/i386 (-p15) and 4.x. Machine
is an i386 machine with an external hardware RAID, shared with
nfs. There are total 20+ nfs client. When one exported space
gets full and some user's program keeping write (probability
with remove) data to this space, sometimes after lots of /dev/xxxxx
is full message, I got this panic.

dev = da0s1d, block = 44652432, fs = /export/b1
panic: ffs_blkfree: freeing free block
cpuid = 3
KDB: enter: panic
[thread 100112]
Stopped at      kdb_enter+0x30: leave
db> wh
kdb_enter(c066992d,3,c0672f0b,e4ba6ae0,5) at kdb_enter+0x30
panic(c0672f0b,c22b58a8,2a95790,0,c23638d4) at panic+0x13e
ffs_blkfree(c2363800,c23cb318,2a95790,0,4000) at ffs_blkfree+0x3d2
indir_trunc(c2690e00,aa55e20,0,1,80c) at indir_trunc+0x30d
handle_workitem_freeblocks(c2690e00,0,2,6,0) at handle_workitem_freeblocks+0x20e
process_worklist_item(0,0,42935dad,0,0) at process_worklist_item+0x1e1
softdep_process_worklist(0,1e,c1f1a320,0,0) at softdep_process_worklist+0xcc
sched_sync(0,e4ba6d48,0,0,0) at sched_sync+0x5f2
fork_exit(c0541295,0,e4ba6d48) at fork_exit+0x80
fork_trampoline() at fork_trampoline+0x8
--- trap 0x1, eip = 0, esp = 0xe4ba6d7c, ebp = 0 ---

The system disk is on ips(4) which does not support dump in 5.3
(supportted in 5.4). So, there is no dump available. I don't exactly
know what kind of accessing pattern causes this. Therefore, no idea
where to start at. Wonder if this can be fixed or so.

Cheers,
Rong-En Fan