CURRENT + amd64 + user-ppp = panic

[Mark Tinguely]

Thank-you for correcting me, I mistakenly did not look at which case
was caught in the trash_dtor().

I also was not thinking MBUF when I suggested trace locations. m_sanity()
in kern/uipc_mbuf.c will also set "0xdeadc0de" if the "sanitize"
option is requested. But common sense says that your trash_dtor()
code should catch this before it gets set, but if you wish to test
there also it would put my mind at ease.

In the mean time, I will look for callouts that are not stopped before
they are freed. So far, I found the &sp->ifstart_callout in the file
net/if_spppsubr.c started but not stopped before freed, but you are
not using that routine. I will concentrate on the files that you listed
were changed.

--Mark Tinguely