RELENG_6: panic in mpt_attach (amd64)

[Michiel Boland]

RELENG_6 on amd64 (Sun V20Z), cvsupped today
GENERIC kernel, except for additions of GEOM_MIRROR and BREAK_TO_DEBUGGER

Crashes immeately on boot

mpt0: <LSILogic 1030 Ultra4 Adapter> port 0x2000-0x20ff mem 
0xfe850000-0xfe85ffff,0xfe840000-0xfe84ffff irq 27 at device 4.0 on pci2
mpt0: [GIANT-LOCKED]
mpt0: MPI Version=1.2.12.0
mpt0: Unhandled Event Notify Frame. Event 0xa.
mpt0: Capabilities: ( RAID-1E RAID-1 SAFTE )
mpt0: 0 Active Volumes (1 Max)
mpt0: 0 Hidden Drive Members (6 Max)
Memory modified after free 0xffffff00f3dec540(8) val=0 @ 
0xffffff00f3dec540
panic: Most recently used by bus

cpuid = 0
KDB: enter: panic
[thread pid 0 tid 0 ]
Stopped at      kdb_enter+0x2f: nop
db> tr
Tracing pid 0 tid 0 td 0xffffffff8081e380
kdb_enter() at kdb_enter+0x2f
panic() at panic+0x249
mtrash_ctor() at mtrash_ctor+0x78
uma_zalloc_arg() at uma_zalloc_arg+0x2c6
malloc() at malloc+0xa3
mpt_core_attach() at mpt_core_attach+0x71a
mpt_attach() at mpt_attach+0x49
mpt_pci_attach() at mpt_pci_attach+0x895
device_attach() at device_attach+0x292
bus_generic_attach() at bus_generic_attach+0x18
acpi_pci_attach() at acpi_pci_attach+0xf1
device_attach() at device_attach+0x292
bus_generic_attach() at bus_generic_attach+0x18
acpi_pcib_attach() at acpi_pcib_attach+0xf0
acpi_pcib_pci_attach() at acpi_pcib_pci_attach+0x97
device_attach() at device_attach+0x292
bus_generic_attach() at bus_generic_attach+0x18
acpi_pci_attach() at acpi_pci_attach+0xf1
device_attach() at device_attach+0x292
bus_generic_attach() at bus_generic_attach+0x18
acpi_pcib_attach() at acpi_pcib_attach+0xf0
acpi_pcib_acpi_attach() at acpi_pcib_acpi_attach+0xdb
device_attach() at device_attach+0x292
bus_generic_attach() at bus_generic_attach+0x18
acpi_attach() at acpi_attach+0x7f1
device_attach() at device_attach+0x292
bus_generic_attach() at bus_generic_attach+0x18
nexus_attach() at nexus_attach+0x19
device_attach() at device_attach+0x292
root_bus_configure() at root_bus_configure+0x1e
configure() at configure+0xa
mi_startup() at mi_startup+0xd3
btext() at btext+0x2c