panic in devstat_remove_entry

[Bruce Cran]

I've found a way to panic 5.2-BETA which I can trigger in two ways.
The first is to get an audio cdrom recognised and the corresponding
/dev/acd0tX nodes created, then replace that cdrom with one with a
standard ISO9660 filesystem.  Upon cat'ing the cdrom, the system panics.
The second way I triggered when I accidentally tried to mount an ISO9660
filesystem as UDF - with the CD in the CDRW drive, the system generates
the same panic as the first.   I've tried, without success, to get a
crash dump to get more information - gdb refuses to load the vmcore.X
file, with a 'vmcore.0: Unknown error: 0' message.  I've attached a 
transcript of the session which produced the panic.  
The kernel and world were compiled with -O
-march=athlon-xp, uname "FreeBSD buffy.brucec.backnet 5.2-BETA FreeBSD
5.2-BETA #0: Fri Dec 5 01:57:14 GMT 2003 bruce at buffy.brucec.backnet:
/usr/obj/usr/src/sys/MYKERNEL  i386" - it was cvsupped and 
rebuilt on Thu 4th Dec.   If there's any other information needed, I
can trigger this on demand so can get further data, and have the full
transcript of the serial session available.

--
Bruce Cran
-------------- next part --------------
# cat /dev/acd0
cat: /dev/acd0: Invalid argument
# ls /dev/acd*
/dev/acd0       /dev/acd0t01    /dev/acd0t02    /dev/acd0t03    /dev/acd1
<SWAP AUDIO CD FOR FREEBSD JP-SNAP CD>
# cat /dev/acd0


Fatal trap 12: page fault while in kernel mode
fault virtual address	= 0x1c
fault code		= supervisor read, page not present
instruction pointer	= 0x8:0xc0505f98
stack pointer	        = 0x10:0xd886ec88
frame pointer	        = 0x10:0xd886ec9c
code segment		= base 0x0, limit 0xfffff, type 0x1b
			= DPL 0, pres 1, def32 1, gran 1
processor eflags	= interrupt enabled, resume, IOPL = 0
current process		= 2 (g_event)
kernel: type 12 trap, code=0
Stopped at      devstat_remove_entry+0x98:      cmpl    %ebx,0x1c(%edx)
db> tr
devstat_remove_entry(c44bd3c0,0,0,c4586e80,d886ecd0) at devstat_remove_entry+0x98
g_destroy_provider(c4586e80,c0653a4c,c4586ed4,c4586e80,4) at g_destroy_provider+0x48
g_orphan_register(c4586e80,0,0,0,66666667) at g_orphan_register+0x5d
one_event(d886ed18,c04b5445,c069ba54,0,4c) at one_event+0xfc
g_run_events(c069ba54,0,4c,c064dd2d,a) at g_run_events+0x8
g_event_procbody(0,d886ed48,0,40,0) at g_event_procbody+0x25
fork_exit(c04b5420,0,d886ed48) at fork_exit+0x7f
fork_trampoline() at fork_trampoline+0x8
--- trap 0x1, eip = 0, esp = 0xd886ed7c, ebp = 0 ---