mount_ntfs causes panic

I updated my laptop kernel to 5.1-CURRENT and got into trouble.

FreeBSD mebius 5.1-CURRENT FreeBSD 5.1-CURRENT #1: Tue Jun 17 09:36:21 JST 2003     root_at_mebius:/usr/obj/usr/src/sys/GENERIC  i386

This laptop also runs Windows 2000 whose filesystem is NTFS and this
NTFS part is mounted from FreeBSD with read-only.

/etc/fstab:
/dev/ad0s2      /mnt/winnt      ntfs    ro,noauto       0       0

When "mount /mnt/winnt", the system falls into DDB.

Here is a backtrace.

(kgdb) bt
#0  doadump () at /usr/src/sys/kern/kern_shutdown.c:240
#1  0xc030f113 in boot (howto=260) at /usr/src/sys/kern/kern_shutdown.c:372
#2  0xc030f483 in panic () at /usr/src/sys/kern/kern_shutdown.c:550
#3  0xc01631b2 in db_panic () at /usr/src/sys/ddb/db_command.c:449
#4  0xc0163132 in db_command (last_cmdp=0xc052a9f0, cmd_table=0x0, 
    aux_cmd_tablep=0xc0521848, aux_cmd_tablep_end=0xc0521860)
    at /usr/src/sys/ddb/db_command.c:346
#5  0xc0163246 in db_command_loop () at /usr/src/sys/ddb/db_command.c:471
#6  0xc0165fda in db_trap (type=3, code=0) at /usr/src/sys/ddb/db_trap.c:73
#7  0xc048ab75 in kdb_trap (type=3, code=0, regs=0xcb48637c)
    at /usr/src/sys/i386/i386/db_interface.c:172
#8  0xc049c21c in trap (frame=
      {tf_fs = -1067581416, tf_es = -884473840, tf_ds = -1070596080, tf_edi = 1, tf_esi = -1068469573, tf_ebp = -884448312, tf_isp = -884448344, tf_ebx = 0, tf_edx = 0, tf_ecx = 32, tf_eax = 18, tf_trapno = 3, tf_err = 0, tf_eip = -1068978668, tf_cs = 8, tf_eflags = 642, tf_esp = -1068390229, tf_ss = -1068493137})
    at /usr/src/sys/i386/i386/trap.c:595
#9  0xc048c4c8 in calltrap () at {standard input}:96
#10 0xc030f41c in panic (
    fmt=0xc05072bb "bundirty: buffer %p still on queue %d")
    at /usr/src/sys/kern/kern_shutdown.c:534
#11 0xc0354331 in bundirty (bp=0xc5b85830) at /usr/src/sys/kern/vfs_bio.c:1126
#12 0xc0354e61 in brelse (bp=0xc5b85830) at /usr/src/sys/kern/vfs_bio.c:1441
---Type <return> to continue, or q <return> to quit---
#13 0xc0353c01 in bwrite (bp=0xc5b85830) at /usr/src/sys/kern/vfs_bio.c:884
#14 0xc0356b82 in getblk (vp=0xc2943000, blkno=13504625, size=1024, slpflag=0, 
    slptimeo=0, flags=0) at /usr/src/sys/kern/vfs_bio.c:2516
#15 0xc03535e2 in breadn (vp=0xc2943000, blkno=0, size=0, rablkno=0x0, 
    rabsize=0x0, cnt=0, cred=0x0, bpp=0x0) at /usr/src/sys/kern/vfs_bio.c:702
#16 0xc035358c in bread (vp=0x0, blkno=0, size=0, cred=0x0, bpp=0x0)
    at /usr/src/sys/kern/vfs_bio.c:684
#17 0xc2977f9b in ntfs_readntvattr_plain (ntmp=0xc22dc000, ip=0xc22dc200, 
    vap=0xc2692a00, roff=0, rsize=0, rdata=0x0, initp=0xcb4866ac, uio=0x0)
    at /usr/src/sys/fs/ntfs/ntfs_subr.c:1555
#18 0xc2978382 in ntfs_readattr_plain (ntmp=0xc22dc000, ip=0xc22dc200, 
    attrnum=128, attrname=0x0, roff=480, rsize=160, rdata=0xcb4867cc, 
    initp=0xcb48674c, uio=0x0) at /usr/src/sys/fs/ntfs/ntfs_subr.c:1646
#19 0xc29788a4 in ntfs_readattr (ntmp=0xc22dc000, ip=0xc22dc200, attrnum=128, 
    attrname=0x0, roff=480, rsize=160, rdata=0xcb4867cc, uio=0x0)
    at /usr/src/sys/fs/ntfs/ntfs_subr.c:1760
#20 0xc297374d in ntfs_mountfs (devvp=0xc2943000, mp=0xc2691400, 
    argsp=0xcb4868e8, td=0xc2026e40) at /usr/src/sys/fs/ntfs/ntfs_vfsops.c:405
#21 0xc297325d in ntfs_mount (mp=0xc2943000, path=0xc2317d80 "/mnt/winnt", 
    data=0x0, ndp=0x3, td=0xc2026e40) at /usr/src/sys/fs/ntfs/ntfs_vfsops.c:235
#22 0xc03613db in vfs_mount (td=0xc2026e40, fstype=0xc2026e40 "t7", 
    fspath=0xc2317d80 "/mnt/winnt", fsflags=-1030475776, fsdata=0x0)
    at /usr/src/sys/kern/vfs_mount.c:1091
---Type <return> to continue, or q <return> to quit---
#23 0xc0360b48 in mount (td=0x0, uap=0xcb486d10)
    at /usr/src/sys/kern/vfs_mount.c:847
#24 0xc049cafe in syscall (frame=
      {tf_fs = 47, tf_es = 47, tf_ds = 47, tf_edi = -1077937176, tf_esi = -1077936859, tf_ebp = -1077937152, tf_isp = -884445836, tf_ebx = -1077938936, tf_edx = -1077936849, tf_ecx = -1077936849, tf_eax = 21, tf_trapno = 12, tf_err = 2, tf_eip = 134520903, tf_cs = 31, tf_eflags = 518, tf_esp = -1077938980, tf_ss = 47}) at /usr/src/sys/i386/i386/trap.c:1023
#25 0xc048c51d in Xint0x80_syscall () at {standard input}:138
---Can't read userspace from dump, or kernel process---
-- 
NAKAJI Hiroyuki