Panic: HEAD as of March 23rd: duplicate free of an mbuf

[John Baldwin]

Panic on a 4 CPU box running buildworld -j 8 in a loop:

FreeBSD/i386 (deimos.baldwin.cx) (ttyd0)

login: Slab at 0xc2280fa8, freei 8 = 0.
panic: Duplicate free of item 0xc2280800 from zone 0xc103d840(Mbuf)

cpuid = 1
KDB: enter: panic
[thread pid 15027 tid 100093 ]
Stopped at      kdb_enter+0x30: leave
db> tr
Tracing pid 15027 tid 100093 td 0xc214e000
kdb_enter(c071f8c3,1,c073217f,e00e1b88,c214e000) at kdb_enter+0x30
panic(c073217f,c2280800,c103d840,c071e194,c2280800) at panic+0x14e
uma_dbg_free(c103d840,0,c2280800,8e4,1) at uma_dbg_free+0x17b
uma_zfree_arg(c103d840,c2280800,0,4ed,c4d44300) at uma_zfree_arg+0x131
soreceive(c4d44298,0,e00e1c80,0,0,e00e1c50,4000) at soreceive+0xa9c
fifo_read_f(c4383ea0,e00e1c80,c2515a00,0,c214e000) at fifo_read_f+0x72
dofileread(c214e000,c4383ea0,3,bfbfd667,1) at dofileread+0xcc
read(c214e000,e00e1d14,c,3ff,3) at read+0x6b
syscall(808002f,836002f,bfbf002f,bfbfd6a0,0) at syscall+0x2a0
Xint0x80_syscall() at Xint0x80_syscall+0x1f
--- syscall (3, FreeBSD ELF32, read), eip = 0x805cd2f, esp = 0xbfbfd64c, ebp = 0xbfbfd668 ---
db> x 0xc2280800,80
0xc2280800:     0               0               c2280830        1
0xc2280810:     8002            1               0               1
0xc2280820:     0               0               6               0
0xc2280830:     2b2b2b2b        0               2000000         a3860100
0xc2280840:     2000000         1000000         1000000         24000000
0xc2280850:     0               0               e9030000        e9030000
0xc2280860:     4000000         e9030000        0               5000000
0xc2280870:     84030000        0               0               177a1cc8
0xc2280880:     cee57618        48144ba7        4000dfbf        c696cf4
0xc2280890:     23e20000        8f517           68000045        4f1c
0xc22808a0:     dadc1140        a00a8c0         100a8c0         a102d602
0xc22808b0:     f6765400        2d3c4842        0               2000000
0xc22808c0:     a4860100        2000000         5000000         0
0xc22808d0:     0               0               0               7000000
0xc22808e0:     2d62686a        637774          c000000         756f7267
0xc22808f0:     79622e70        656d616e        4000000         6e686f6a
0xc2280900:     0               0               c228098a        76
0xc2280910:     8002            1               0               76
0xc2280920:     0               0               6               0
0xc2280930:     2b2b            0               3f000000        2b2b2b2b
0xc2280940:     3002b2b         3000000         1000000         24000000
0xc2280950:     0               0               e9030000        e9030000
0xc2280960:     4000000         e9030000        0               5000000
0xc2280970:     84030000        0               0               0
0xc2280980:     0               0               40008701        c696cf4
0xc2280990:     23e20000        8f517           68000045        b91b
0xc22809a0:     70dd1140        a00a8c0         100a8c0         a102fcff
0xc22809b0:     a6c85400        e06f4f42        0               2000000
0xc22809c0:     a4860100        2000000         3000000         0
0xc22809d0:     0               0               0               7000000
0xc22809e0:     2d62686a        637774          c000000         73736170
0xc22809f0:     622e6477        64697579        3000000         303039

-- 
John Baldwin <jhb at FreeBSD.org>  <><  http://www.FreeBSD.org/~jhb/
"Power Users Use the Power to Serve"  =  http://www.FreeBSD.org