CURRENT + amd64 + user-ppp = panic

[Mark Tinguely]

Okay, I am alittle dense in reading the soreceive() debugger line,
basically the debugger trace must refer to an expansion of the m_free()
inline definition in soreceive().

Either a callout is not being removed when the memory is freed
and that memory is recycled to an MBUF OR someone is incorrectly
chaining a memory location into an MBUF.

before too much work is done (below), could you print out the callout
that is being freed but active and the memory around it (before it
is overwritten by "deadc0de"). It may tell us which callout that it
is or was. You should be able to do that with your existing kernel.

If we cannot glean who the callout is/was, then more tests can be
added to determine if the UMA is allocating memory chained to the callout
or if the MBUF chain is corrupted.

--Mark Tinguely