panic: bremfree: removing a buffer not on a queue

Hi,

I've got the following panic, when I ran out of space. My system is from about
17 Jun. It acts as a NFS and Samba server, but panic happend at night, when no
activity on those daemons occurs. Write could happen through ssh (as I
suppose). The filesystems are UFS1 and UFS2. The one, on which I suppose the
write happend is UFS1.

I do not have apropriate sources, so no debugging kernel version is available
:/


Cheers,

Wiktor Niesiobedzki

$ uname -a
FreeBSD portal 5.1-CURRENT FreeBSD 5.1-CURRENT #0: Wed Jun 18 02:39:29 CEST
2003     root_at_portal:/usr/obj/usr/src/sys/PORTAL  i386


# gdb -k /boot/kernel/kernel vmcore.1
GNU gdb 5.2.1 (FreeBSD)
Copyright 2002 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i386-undermydesk-freebsd"...(no debugging symbols found)...
panic: page fault
panic messages:
---
Fatal trap 12: page fault while in kernel mode
fault virtual address	= 0x2f
fault code		= supervisor read, page not present
instruction pointer	= 0x8:0xc0238404
stack pointer	        = 0x10:0xccf56b5c
frame pointer	        = 0x10:0xccf56b7c
code segment		= base 0x0, limit 0xfffff, type 0x1b
			= DPL 0, pres 1, def32 1, gran 1
processor eflags	= interrupt enabled, resume, IOPL = 0
current process		= 3 (g_up)
trap number		= 12
panic: page fault

syncing disks, buffers remaining... panic: bremfree: removing a buffer not on a queue
Uptime: 12d15h6m53s
Dumping 256 MB
ata1: resetting devices ..
done
 16 32 48 64 80 96 112 128 144 160 176 192 208 224 240
---
Reading symbols from /boot/kernel/if_dc.ko...(no debugging symbols found)...done.
Loaded symbols for /boot/kernel/if_dc.ko
Reading symbols from /boot/kernel/miibus.ko...(no debugging symbols found)...done.
Loaded symbols for /boot/kernel/miibus.ko
Reading symbols from /boot/kernel/if_rl.ko...(no debugging symbols found)...done.
Loaded symbols for /boot/kernel/if_rl.ko
Reading symbols from /usr/obj/usr/src/sys/PORTAL/modules/usr/src/sys/modules/random/random.ko...
(no debugging symbols found)...done.
Loaded symbols for /usr/obj/usr/src/sys/PORTAL/modules/usr/src/sys/modules/random/random.ko
Reading symbols from /usr/obj/usr/src/sys/PORTAL/modules/usr/src/sys/modules/dummynet/dummynet.ko...
(no debugging symbols found)...done.
Loaded symbols for /usr/obj/usr/src/sys/PORTAL/modules/usr/src/sys/modules/dummynet/dummynet.ko
Reading symbols from /usr/obj/usr/src/sys/PORTAL/modules/usr/src/sys/modules/ipfw/ipfw.ko...
(no debugging symbols found)...done.
Loaded symbols for /usr/obj/usr/src/sys/PORTAL/modules/usr/src/sys/modules/ipfw/ipfw.ko
Reading symbols from /usr/obj/usr/src/sys/PORTAL/modules/usr/src/sys/modules/nfsserver/nfsserver.ko...
(no debugging symbols found)...done.
Loaded symbols for /usr/obj/usr/src/sys/PORTAL/modules/usr/src/sys/modules/nfsserver/nfsserver.ko
Reading symbols from /usr/obj/usr/src/sys/PORTAL/modules/usr/src/sys/modules/if_tun/if_tun.ko...
(no debugging symbols found)...done.
Loaded symbols for /usr/obj/usr/src/sys/PORTAL/modules/usr/src/sys/modules/if_tun/if_tun.ko
Reading symbols from /boot/kernel/netgraph.ko...(no debugging symbols found)...done.
Loaded symbols for /boot/kernel/netgraph.ko
Reading symbols from /boot/kernel/ng_ether.ko...(no debugging symbols found)...done.
Loaded symbols for /boot/kernel/ng_ether.ko
Reading symbols from /boot/kernel/ng_pppoe.ko...(no debugging symbols found)...done.
Loaded symbols for /boot/kernel/ng_pppoe.ko
Reading symbols from /boot/kernel/ng_socket.ko...(no debugging symbols found)...done.
Loaded symbols for /boot/kernel/ng_socket.ko
#0  0xc019221b in doadump ()
(kgdb) bt
#0  0xc019221b in doadump ()
#1  0xc019289d in boot ()
#2  0xc0192c59 in panic ()
#3  0xc01d8b50 in bremfreel ()
#4  0xc01d8a62 in bremfree ()
#5  0xc01dbf00 in getblk ()
#6  0xc01d8c22 in breadn ()
#7  0xc01d8bcc in bread ()
#8  0xc0229993 in ffs_update ()
#9  0xc023ee0f in ffs_fsync ()
#10 0xc023dd3f in ffs_sync ()
#11 0xc01f05eb in sync ()
#12 0xc01923bf in boot ()
#13 0xc0192c59 in panic ()
#14 0xc029db02 in trap_fatal ()
#15 0xc029d7e2 in trap_pfault ()
#16 0xc029d362 in trap ()
#17 0xc028db78 in calltrap ()
#18 0xc0238131 in softdep_disk_write_complete ()
#19 0xc01d93cb in vfs_backgroundwritedone ()
#20 0xc01dcf34 in bufdone ()
#21 0xc01dcec4 in bufdonebio ()
#22 0xc01dccdb in biodone ()
#23 0xc015cb2b in g_dev_done ()
#24 0xc01dccdb in biodone ()
#25 0xc015f420 in g_io_schedule_up ()
#26 0xc015f638 in g_up_procbody ()
#27 0xc017c5f0 in fork_exit ()