Memory modified after free - Jan20 -CURRENT

[Ketrien I. Saihr-Kenchedra]

Screen transcription attached. In a nutshell;

fdc0: <floppy drive controller> port 0x3f7,0x3f0-0x3f5 irq 6 drq 2 on acpi0
device_attach: fdc0 returned 6
sio0: <16550A-compatible COM port> port0x3f8-0x3ff irq 4 flags 0x10 on acpi0
sio0: type 16550A
Memory modified after free 0xc1cde200(252) val=0 @ 0xc1cde228
panic: Most recently used by none

System was fine with Jan16 srcs, fdc returning 6 is new. Looks like a uma
problem to me, but odd enough that I'm honestly not sure. Need ips(4) for
dumpdev, so no dump again. (Argh.)

-Ketrien I. Saihr-Kenchedra
<Mitsune_Konno> Yeah, except starbucks sucks
<Mitsune_Konno> for some reason you can getevery color of coffee except black
-------------- next part --------------
fdc0: <floppy drive controller> port 0x3f7,0x3f0-0x3f5 irq 6 drq 2 on acpi0
device_attach: fdc0 returned 6
sio0: <16550A-compatible COM port> port0x3f8-0x3ff irq 4 flags 0x10 on acpi0
sio0: type 16550A
Memory modified after free 0xc1cde200(252) val=0 @ 0xc1cde228
panic: Most recently used by none


cpuid = 0
KDB: enter: panic
[thread pid0 tid 0 ]
Stopped at kdb_enter+0x30: leave
db>
db> trace
Tracing pid 0 tid 0 td 0xc074de40
kdb_enter(c06f02a8,0,c0704654,c0c20964,c074de40) at kdb_enter+0x30
panic(c0704654,c06e449c,fc,0,c1cde228) at panic+0x14e
mtrash_ctor(c1cde200,100,0,102,c1cde200) at mtrash_ctor+0x65
uma_zalloc_arg(c1052840,0,102,c1064b40,c1cf2730) at uma_zalloc_arg+0x1c8
malloc(d8,c0727760,102,c0c20a04,c050b409) at malloc+0xd6
pstats_alloc(c1cf1c38,c06ef960,0,20,6) at pstats_alloc+0x22
proc_init(c1cf1bd0,1f8,103,103,c1cf1000) at proc_init+0x69
slab_zalloc(c103e160,103,c065d8af,c103e160,c1cf0fc4) at slab_zalloc+0x2c0
uma_zone_slab(c103e160,3,c050978a,c07ab100,2) at uma_zone_slab+0x117
uma_zalloc_bucket(c103e160,3,c0704017,76d,c050999d) at uma_zalloc_bucket+0x16f
uma_zalloc_arg(c103e160,0,2,c06f3a0f,4ee) at uma_zalloc_arg+0x36d
fork1(c074de40,60034,0,c0c20b1c,c1cc8dda) at fork1+0x143
kthread_create(c04fc390,c1cc8d80,c0c20b4c,60000,0) at kthread_create+0x48
ithread_create(c0c20b80,0,1,0,0) at ithread_create+0xd4
swi_add(c074e624,c0707df5,c0687b80,0,0) at swi_add+0x83
sioattach(c1cbe380,0,0,c0c20c1c,c052d07a) at sioattach+0x491
sio_isa_attach(c1cbe380,c1c6904c,c0722c94,c1cbe380,c1cbe380) at sio_isa_attach+0x21
device_attach(c1cbe380c1cbe380,c06f1d1a,8da,c0c20c54) at device_attach+0x6a
device_probe_and_attach(c1cbe380,ee9b,c0c20cac,c08830f4,c1c57600) at device_probe_and_attach+0x111
bus_generic_attach(c1c57600,ee9b,ee9b,c1cb7bc8,ee9b) at bus_generic_attach+0x28
acpi_attach(c1c57600,c1c9204c,c0722c94,c1c57600,c1c57600) at acpi_attach+0x904
device_attach(c1c576000,c1c57600,c06f1d1a,8da,c0c20d04) at device_attach+0x6a
device_probe_and_attach(c1c57600,c1c57780,c0c20d14,c06ae18a,c1c57780) at device_probe_and_attach+0x111
bus_generic_attach(c1c57780,c1c57780,c0c20d34,c052d07a,c1c57780) at bus_generic_attach+0x28
nexus_attach(c1c57780,c1c8384c,c0722c94,c1c57780,c1c57780) at nexus_attach+0x1a
device_attach(c1c57780,c1c57780,c06f1d1a,8da,c0739a30) at device_attach+0x6a
device_probe_and_attach(c1c57780,c1bc97ac,c0c20d80,c0699ae9,c1c57d00) at device_probe_and_attach+0x111
root_bus_configure(c1c57d00,c070b31f,0,c0c20d98,c04e40f5) at root_bus_configure+0x28
configure(0,c1e000,c1ec00,c1e000,0) at configure+0x29
mi_startup() at mi_startup+0xb5
begin() at begin+0x2c
db>