ubt0, Bluetooth and kernel memory leaking

Hi,

It seems when using rfcomm_pppd (at least) as a Bluetooth <-> LAN
gateway there is a fairly large memory leak which eventually crashes
the box running the ppp server.  To track down where, I recorded the
output of kern.malloc every minute until the box crashed.  At the
start of the debugging run, I saw:

       devbuf   441  2650K   2861K     2504  16,32,64,128,256,512,1024,2048,4096,8192,16384,65536


A mere 32 minutes later (right before it crashed), it was up a
considerable ammount:

       devbuf 89943184451K 184451K    92399  16,32,64,128,256,512,1024,2048,4096,8192,16384,65536

I'm pretty sure that kernel virtual memory got exhausted and the
machine paniced and rebooted.

I'm not even sure where to start looking for this. I'm using a MSI USB
dongle:

ubt0: vendor 0x0db0 product 0x1967, rev 1.10/5.25, addr 2
ubt0: Interface 0 endpoints: interrupt=0x81, bulk-in=0x82, bulk-out=0x2
ubt0: Interface 1 (alt.config 5) endpoints: isoc-in=0x83, isoc-out=0x3; wMaxPacketSize=49; nframes=6, buffer size=294

% sh /etc/rc.bluetooth start ubt0
BD_ADDR: 00:10:dc:e9:59:f4
Features: 0xff 0xff 0xf 00 00 00 00 00 
<3-Slot> <5-Slot> <Encryption> <Slot offset>
<Timing accuracy> <Switch> <Hold mode> <Sniff mode>
<Park mode> <RSSI> <Channel quality> <SCO link>
<HV2 packets> <HV3 packets> <u-law log> <A-law log> <CVSD>
<Paging scheme> <Power control> <Transparent SCO data> 
Max. ACL packet size: 192 bytes
Number of ACL packets: 8
Max. SCO packet size: 64 bytes
Number of SCO packets: 8

This is on -current from approx. Aug 14 2003.

The other end (client) was another MSI USB dognle on a Windows laptop.

Any ideas?

Thanks,

Gary