panic when portupgrade in jail (devfs related?)

[Rong-en Fan]

Hi,

I'm running RELENG_6 as of yesterday on a amd64 box.
This host has one jail running, and everytime when I try
to run portupgrade inside the jail. It panics. INVARIANTS
does not catch anything. I don't think this happens on
RELENG_6 two months ago. The panic messages
and backtrace are shown:

Fatal trap 12: page fault while in kernel mode
cpuid = 1; apic id = 01
fault virtual address   = 0xfffffffe75b851b0
fault code              = supervisor read, page not present
instruction pointer     = 0x8:0xffffffff80231118
stack pointer           = 0x10:0xffffffffb40a5860
frame pointer           = 0x10:0xffffffffb40a5880
code segment            = base 0x0, limit 0xfffff, type 0x1b
                        = DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags        = interrupt enabled, resume, IOPL = 0
current process         = 60200 (script)
[thread pid 60200 tid 100268 ]
Stopped at      ptcclose+0x19:  movq    linesw(,%rdx,8),%rax
db> bt
Tracing pid 60200 tid 100268 td 0xffffff006c4ec720
ptcclose() at ptcclose+0x19
giant_close() at giant_close+0x5f
devfs_close() at devfs_close+0x28f
VOP_CLOSE_APV() at VOP_CLOSE_APV+0x6e
vn_close() at vn_close+0x90
vn_closefile() at vn_closefile+0x88
fdrop_locked() at fdrop_locked+0xa5
closef() at closef+0x35f
close() at close+0x173
syscall() at syscall+0x4a1
Xfast_syscall() at Xfast_syscall+0xa8
--- syscall (6, FreeBSD ELF64, close), rip = 0x800807f9c, rsp =
0x7fffffffdfa8, rbp = 0 ---

I put the box back to production. If anyone needs more information,
I can reproduce this panic and gather them in ddb. BTW, I used
'call doadump' in ddb, but after rebooting, savecore complains
there is no dump?

Regards,
Rong-En Fan