Panic on boot on my Samsung Sens Pro 500

[M. Warner Losh]

# This is RELENG_5

GDB: no debug ports present
KDB: debugger backends: ddb
KDB: current backend: ddb
SMAP type=01 base=0000000000000000 len=000000000009fc00
SMAP type=02 base=000000000009fc00 len=0000000000000400
SMAP type=02 base=00000000000e77e2 len=00000000000071d0
SMAP type=02 base=00000000000f20a8 len=000000000000df58
SMAP type=01 base=0000000000100000 len=0000000001700000
SMAP type=02 base=00000000ffff20a8 len=000000000000df58
Copyright (c) 1992-2004 The FreeBSD Project.
Copyright (c) 1979, 1980, 1983, 1986, 1988, 1989, 1991, 1992, 1993, 1994
        The Regents of the University of California. All rights reserved.
FreeBSD 5.3-STABLE #1: Sun Oct 31 14:42:40 MST 2004
    imp at paco-paco.village.org:/paco/imp/FreeBSD/5x/src/sys/i386/compile/GENERIC
kernel trap 12 with interrupts disabled


Fatal trap 12: page fault while in kernel mode
fault virtual address   = 0x1c
fault code              = supervisor read, page not present
instruction pointer     = 0x8:0xc0761974
stack pointer           = 0x10:0xc0c21ba4
frame pointer           = 0x10:0xc0c21c70
code segment            = base 0x0, limit 0xfffff, type 0x1b
                        = DPL 0, pres 1, def32 1, gran 1
processor eflags        = interrupt enabled, resume, IOPL = 0
current process         = 0 ()
[thread 0]
Stopped at      vm_fault+0x1b0: cmpxchgl        %ecx,0x1c(%edx)
db> trace
vm_fault(c103a000,c0f75000,1,0,c08dc560) at vm_fault+0x1b0
trap_pfault(c0c21cd8,0,c0f750f4) at trap_pfault+0x19f
trap(18,10,10,c1044420,c1045780) at trap+0x315
calltrap() at calltrap+0x5
--- trap 0xc, eip = 0xc0f750f4, esp = 0xc0c21d18, ebp = 0xc0c21d44 ---
end(c1044420,102,c0843640,c08b48f0,c26000) at 0xc0f750f4
uma_prealloc(c1044420,800,c0c21d84,c07655e4,c10b3000) at uma_prealloc+0x64
pmap_init(c10b3000,fffff000,c10b3000,c0c21d98,c05eb4c2) at pmap_init+0x67
vm_mem_init(0,c1ec00,c1e000,0,c043fb65) at vm_mem_init+0x38
mi_startup() at mi_startup+0x96
begin() at begin+0x2c
db>

uma_prealloc + 100 (0x64) looks like:

0xc077733a <uma_prealloc+94>:   push   %edi
0xc077733b <uma_prealloc+95>:   call   0xc0774c78 <slab_zalloc>
0xc0777340 <uma_prealloc+100>:  mov    %eax,%ecx

0xc0f750f4 is outside of the text area (so I suspect that our stalk
walker is a little hozed :-(.  Also of interest is that I couldn't
boot on the video console, but had to boot over serial to even get
this far.

This seems to correspond to:
	while (slabs > 0) {
-->		slab = slab_zalloc(zone, M_WAITOK);
		LIST_INSERT_HEAD(&keg->uk_free_slab, slab, us_link);
		slabs--;
	
	}

But without more specific information about the zalloc, it is hard to
know what to do.  The crash is 100% repeatable.

Same kernel boots fine on my Dell Inspiron 3000, so it can't be the
kernel being corrupt.  The same disk boots before and after on the
i3k (the disk was cloned from the i3k disk...)

Ideas?

Warner