kern/80035: netgraph is causing crash (free()->panic) with mpd

[Ivan]

>Number:         80035
>Category:       kern
>Synopsis:       netgraph is causing crash (free()->panic) with mpd
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Sun Apr 17 17:00:36 GMT 2005
>Closed-Date:
>Last-Modified:
>Originator:     Ivan
>Release:        5.4-RC2
>Organization:
Micron-Media
>Environment:
FreeBSD micron-media.ru 5.4-RC2 FreeBSD 5.4-RC2 #6: Tue Apr 12 16:53:37 MSD 2005     root at micron-media.ru:/usr/obj/usr/src/sys/MKMEDIA  i386
>Description:
After switching vpn-server from poptop to mpd, my box started to crash periodically (from hour to several days of uptime). Normally, there is 50..70 users, connected to VPN. Just before crash, mpd is disconnecting someone. 

mpd patches applied: mpd 3.18 + drop-user patch from ftp://ftp.ufanet.ru/pub/boco/mpd/ (but it shouldn't affect netgraph-related stuff).

Kernel config: HZ=1000, SMP (HyperThreading), ALTQ, netgraph compiled-in  (only ng_vjc.ko via module).

gcc flags: -O -pipe 

dmesg output:
 Free item, freed at /usr/src/sys/netgraph/ng_base.c, line 3652
 problem discovered at file /usr/src/sys/netgraph/ng_base.c, line 3646
 Free item, freed at /usr/src/sys/netgraph/ng_base.c, line 3652
 problem discovered at file /usr/src/sys/netgraph/ng_base.c, line 3193
 Free item, freed at /usr/src/sys/netgraph/ng_base.c, line 3652
 problem discovered at file /usr/src/sys/netgraph/ng_base.c, line 3193
 Free item, freed at /usr/src/sys/netgraph/ng_base.c, line 3652
 problem discovered at file /usr/src/sys/netgraph/ng_base.c, line 3193
 Free item, freed at /usr/src/sys/netgraph/ng_base.c, line 3652
 problem discovered at file /usr/src/sys/netgraph/ng_base.c, line 3193
node 0xc29ad800 ([1ce9])
panic: free item!
cpuid = 1
boot() called on cpu#0
Uptime: 3d3h55m37s
Cannot dump. No dump device defined.
Automatic reboot in 15 seconds - press a key on the console to abort
Rebooting...
cpu_reset called on cpu#0
cpu_reset: Stopping other CPUs

>How-To-Repeat:
When mpd is serving about 60..70 users, system crashes. I wasn't able to find an exact way to reproduce the crash.
>Fix:
      
>Release-Note:
>Audit-Trail:
>Unformatted: