Panic in ip_input

Hi,

with a -CURRENT from yesterday, I get a panic when copying large amounts
of data from my laptop to the desktop system (panic on the desktop):

panic: page fault
panic messages:
---
Fatal trap 12: page fault while in kernel mode
fault virtual address   = 0x0
fault code              = supervisor write, page not present
instruction pointer     = 0x8:0xc0584194
stack pointer           = 0x10:0xce6ffa90
frame pointer           = 0x10:0xce6ffab4
code segment            = base 0x0, limit 0xfffff, type 0x1b
                        = DPL 0, pres 1, def32 1, gran 1
processor eflags        = interrupt enabled, resume, IOPL = 0
current process         = 269 (natd)
trap number             = 12
panic: page fault

syncing disks, buffers remaining... 2201 2199 2199 2199 2199 2199 2199
2199 2199 2199 2199 2199 2199 2199 2199 2199 2199 2199 2199 2199 2199 
giving up on 181 buffers
Uptime: 5m56s
Dumping 255 MB
 16 32 48 64 80 96 112 128[CTRL-C to abort] [CTRL-C to abort]  144 160
176 192 208 224 240
---

(kgdb) where
#0  doadump () at /usr/src/sys/kern/kern_shutdown.c:240
#1  0xc0564ada in boot (howto=256) at
/usr/src/sys/kern/kern_shutdown.c:372
#2  0xc0564e58 in panic () at /usr/src/sys/kern/kern_shutdown.c:550
#3  0xc06d977e in trap_fatal (frame=0xce6ffa50, eva=0)
    at /usr/src/sys/i386/i386/trap.c:821
#4  0xc06d9493 in trap_pfault (frame=0xce6ffa50, usermode=0, eva=0)
    at /usr/src/sys/i386/i386/trap.c:735
#5  0xc06d906d in trap (frame=
      {tf_fs = 24, tf_es = 16, tf_ds = 16, tf_edi = -1049795072, tf_esi
= 0, tf_ebp = -831522124, tf_isp = -831522180, tf_ebx = -831521932,
tf_edx = 1, tf_ecx = -831522000, tf_eax = 0, tf_trapno = 12, tf_err = 2,
tf_eip = -1067957868, tf_cs = 8, tf_eflags = 66050, tf_esp =
-1026868096, tf_ss = -831522136})
    at /usr/src/sys/i386/i386/trap.c:420
#6  0xc06cb888 in calltrap () at {standard input}:94
#7  0xc05ed8a9 in ip_input (m=0x0) at
/usr/src/sys/netinet/ip_input.c:364
#8  0xc05e6292 in div_output (so=0xc2f11d20, m=0xc16d6600,
sin=0xc2d834b0, 
    control=0x0) at /usr/src/sys/netinet/ip_divert.c:364
#9  0xc05e6b1d in div_send (so=0x0, flags=0, m=0x0, nam=0x0,
control=0x0, 
    td=0xc2cb3c80) at /usr/src/sys/netinet/ip_divert.c:518
#10 0xc05a1fcd in sosend (so=0xc2f11d20, addr=0xc2d834b0,
uio=0xce6ffc4c, 
    top=0xc16d6600, control=0x0, flags=0, td=0xc2cb3c80)
    at /usr/src/sys/kern/uipc_socket.c:715
#11 0xc05a6500 in kern_sendit (td=0xc2cb3c80, s=3, mp=0xce6ffcc4,
flags=0, 
---Type <return> to continue, or q <return> to quit---
    control=0x0) at /usr/src/sys/kern/uipc_syscalls.c:723
#12 0xc05a633d in sendit (td=0x0, s=0, mp=0xce6ffcc4, flags=0)
    at /usr/src/sys/kern/uipc_syscalls.c:663
#13 0xc05a66eb in sendto (td=0x0, uap=0x0)
    at /usr/src/sys/kern/uipc_syscalls.c:784
#14 0xc06d9ae0 in syscall (frame=
      {tf_fs = 47, tf_es = 47, tf_ds = 47, tf_edi = -1078006400, tf_esi
= 1, tf_ebp = -1077940840, tf_isp = -831521420, tf_ebx = 1420, tf_edx =
-1078006400, tf_ecx = 671622200, tf_eax = 133, tf_trapno = 0, tf_err =
2, tf_eip = 671942895, tf_cs = 31, tf_eflags = 582, tf_esp =
-1078006548, tf_ss = 47})
    at /usr/src/sys/i386/i386/trap.c:1010
#15 0xc06cb8dd in Xint0x80_syscall () at {standard input}:136
---Can't read userspace from dump, or kernel process---

(kgdb) frame 7
#7  0xc05ed8a9 in ip_input (m=0x0) at
/usr/src/sys/netinet/ip_input.c:364
364                             m_free(m0);
(kgdb) p m0
$1 = (struct mbuf *) 0x0
(kgdb) l
359
360                     m0 = m;
361                     m = m->m_next;
362                     /* XXX: This is set by ip_fastforward */
363                     if (m0->m_nextpkt == (struct mbuf *)1)
364                             m_free(m0);
365             }
366
367             M_ASSERTPKTHDR(m);
368


This panic is relatively easy to recreate. 

Some data points:

The machine is an Athlon Thunderbird 1200 (CPUTYPE=athlon-tbird in
make.conf), the NIC is a Realtek 8139. 
net.inet.ip.fastforwarding is 0.

I have a dump available (256M). What can I do to help fix this problem? 


Thanks,
-- 
Andreas Kohn <andreas.kohn_at_gmx.net>