panic (trap 12 page fault) in bfe driver

[Ben Kaduk]

prolepsis# uname -a
FreeBSD prolepsis.mooo.com 5.3-STABLE FreeBSD 5.3-STABLE #0: Wed Dec
15 23:44:53 CST 2004    
root at prolepsis.mooo.com:/usr/obj/usr/src/sys/GENERIC  i386

On my laptop, issuing a simple:
# ifconfig bfe0 down
# ifconfig bfe0 up
causes the following panic (hand transcribed):
Fatal trap 12: page fault while in kernel mode
fault virtual address = 0xb
fault code = supervisor read, page not present
instruction pointer = 0x8:0xc0832b46
stack pointer = 0x10:0xf0811abc
frame pointer = 0x10:0xf0811ad0
code segment = base 0x0, limit 0xfffff, type 0x1b
                   = DPL 0, pres 1, def32 1, gran 1
processor eflags = interrupt enabled, resume, IOPL = 0
current process = 10990 (ifconfig)
trap number = 12
panic: page fault
Uptime: 2d21h46m17s

last logged console messages:
Jan 29 15:37:33 prolepsis dhclient: send_packet: Network is down
Jan 29 15:37:36 prolepsis last message repeated 2 times
Jan 29 15:37:40 prolepsis login: ROOT LOGIN (root) on ttyv1
Jan 29 15:37:43 prolepsis dhclient: send_packet: Network is down

I had issued the 'ifconfig bfe0 down' then unplugged the ethernet
cable, moved to a different jack, and plugged the cable in; the root
login was me logging in to issue the 'ifconfig bfe0 up' command.  It
appears that there had been some local trouble on the local network,
as the send_packet messages were also present on my other machine; the
network trouble seemed to affect the dhcp server, because upon reboot
dhclient did not seem to be able to find a server, assigning a
10.0.0.1 address (instead of the 130.126.xx.xx that should have shown
up), prompting me to issue another sequence of 'ifconfig bfe0 down'
and 'ifconfig bfe0 up' which resulted in the same panic.
Is this panic caused by external troubles, or should I provide further
information?

I am currently building a debug kernel (GENERIC + DDB, KDB) -- are
there any other options that I should include?

The dmesg of a verbose boot is attached.

Thanks
Benjamin Kaduk
-------------- next part --------------
A non-text attachment was scrubbed...
Name: dmesg.boot.verbose
Type: application/octet-stream
Size: 31711 bytes
Desc: not available
Url : http://lists.freebsd.org/pipermail/freebsd-current/attachments/20050129/f93648b2/dmesg.boot-0001.obj