10.0-BETA3 Fatal trap 12 with jail and VIMAGE RACCT RCTL options

[Ivan Klymenko]

I have
FreeBSD 10.0-BETA3 #0 r257891 amd64

I built a kernel with options VIMAGE RACCT RCTL and run the jail with
vnet option - as a result of getting the kernel trap.

Fatal trap 12: page fault while in kernel mode
cpuid = 2; apic id = 02
fault virtual address   = 0x0
fault code              = supervisor read data, page not present
instruction pointer     = 0x20:0xffffffff80abab89
stack pointer           = 0x28:0xfffffe01f489e4c0
frame pointer           = 0x28:0xfffffe01f489e4f0
code segment            = base 0x0, limit 0xfffff, type 0x1b
                        = DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags        = interrupt enabled, resume, IOPL = 0
current process         = 24532 (jail)
trap number             = 12
panic: page fault
cpuid = 2
...
KDB: stack backtrace:
#0 0xffffffff808f99f0 at kdb_backtrace+0x60
#1 0xffffffff808c0fb5 at panic+0x155
#2 0xffffffff80ce1052 at trap_fatal+0x3a2
#3 0xffffffff80ce1329 at trap_pfault+0x2c9
#4 0xffffffff80ce0ab6 at trap+0x5e6
#5 0xffffffff80cc7d52 at calltrap+0x8
#6 0xffffffff80aba808 at pf_altq_ifnet_event+0x48
#7 0xffffffff80ab8aa3 at pfi_attach_ifnet_event+0x63
#8 0xffffffff80977de3 at if_attach_internal+0x463
#9 0xffffffff809829ca at lo_clone_create+0x9a
#10 0xffffffff8097e1d5 at if_clone_createif+0xb5
#11 0xffffffff8097ecbe at if_clone_simple+0xbe
#12 0xffffffff80982903 at vnet_loif_init+0x23
#13 0xffffffff80991837 at vnet_sysinit+0x77
#14 0xffffffff8099164f at vnet_alloc+0xdf
#15 0xffffffff80892670 at kern_jail_set+0x1af0
#16 0xffffffff80894571 at sys_jail_set+0x41
#17 0xffffffff80ce1947 at amd64_syscall+0x357
Uptime: 1h37m6s
#0  doadump (textdump=<value optimized out>) at pcpu.h:219
219     pcpu.h: No such file or directory.
        in pcpu.h
(kgdb) #0  doadump (textdump=<value optimized out>) at pcpu.h:219
#1  0xffffffff808c0c30 in kern_reboot (howto=260)
    at /usr/src/sys/kern/kern_shutdown.c:447
#2  0xffffffff808c0ff4 in panic (fmt=<value optimized out>)
    at /usr/src/sys/kern/kern_shutdown.c:754
#3  0xffffffff80ce1052 in trap_fatal (frame=<value optimized out>,
    eva=<value optimized out>) at /usr/src/sys/amd64/amd64/trap.c:882
#4  0xffffffff80ce1329 in trap_pfault (frame=0xfffffe01f489e410, usermode=0)
    at /usr/src/sys/amd64/amd64/trap.c:699
#5  0xffffffff80ce0ab6 in trap (frame=0xfffffe01f489e410)
    at /usr/src/sys/amd64/amd64/trap.c:463
#6  0xffffffff80cc7d52 in calltrap ()
    at /usr/src/sys/amd64/amd64/exception.S:232
#7  0xffffffff80abab89 in pf_begin_altq (ticket=0xfffffe01f489e504)
    at /usr/src/sys/netpfil/pf/pf_ioctl.c:491
#8  0xffffffff80aba808 in pf_altq_ifnet_event (ifp=0xfffff800746f7000,
    remove=0) at /usr/src/sys/netpfil/pf/pf_ioctl.c:651
#9  0xffffffff80ab8aa3 in pfi_attach_ifnet_event (arg=<value optimized out>,
    ifp=0xfffff800746f7000) at /usr/src/sys/netpfil/pf/pf_if.c:782
#10 0xffffffff80977de3 in if_attach_internal (ifp=0xfffff800746f7000,
    vmove=<value optimized out>) at /usr/src/sys/net/if.c:693
#11 0xffffffff809829ca in lo_clone_create (ifc=<value optimized out>, unit=0,
    params=<value optimized out>) at /usr/src/sys/net/if_loop.c:150
#12 0xffffffff8097e1d5 in if_clone_createif (ifc=0xfffff8003d07c080,
    name=0xfffffe01f489e640 "lo0", len=16, params=0x0)
    at /usr/src/sys/net/if_clone.c:649
#13 0xffffffff8097ecbe in if_clone_simple (name=<value optimized out>,
    create=<value optimized out>, destroy=<value optimized out>, minifs=1)
    at /usr/src/sys/net/if_clone.c:428
#14 0xffffffff80982903 in vnet_loif_init (unused=<value optimized out>)
    at /usr/src/sys/net/if_loop.c:163
#15 0xffffffff80991837 in vnet_sysinit () at /usr/src/sys/net/vnet.c:617
#16 0xffffffff8099164f in vnet_alloc () at /usr/src/sys/net/vnet.c:256
#17 0xffffffff80892670 in kern_jail_set (td=0xfffff80162c1f490,
    optuio=0xfffff800b2047e00, flags=0) at /usr/src/sys/kern/kern_jail.c:1297
#18 0xffffffff80894571 in sys_jail_set (td=0xfffff80162c1f490,
    uap=0xfffffe01f489ea40) at /usr/src/sys/kern/kern_jail.c:518
#19 0xffffffff80ce1947 in amd64_syscall (td=0xfffff80162c1f490, traced=0)
    at subr_syscall.c:134
#20 0xffffffff80cc803b in Xfast_syscall ()
    at /usr/src/sys/amd64/amd64/exception.S:391
#21 0x0000000800eb38da in ?? ()
Previous frame inner to this frame (corrupt stack?)
Current language:  auto; currently minimal
(kgdb)

I can provide all the necessary information, but I need your help.

Thanks.