panic in ata_boot_attach

I got a panic when booting with a kernel as of today.  Right before the
panic, I get "ata1-slave: TIMEOUT in ATAPI_IDENTIFY retrying, 3 tries left
LBA=0".  Note that on the ata1 channel, I only have one device (a CDROM,
a master).

It works fine with a kernel as of Dec 30.  The panic msg is a read on page
not present.  I'm guessing the atadev or param pointers are invalid.

Here is the call stack:

(gdb) l *ata_getparam+0xb6
0xc045d716 is in ata_getparam (../../../dev/ata/ata-all.c:585).
580                         break;
581                     request->retries--;
582                 }
583                 ata_free_request(request);
584             }
585             if (!isprint(atadev->param->model[0]) ||
586                 !isprint(atadev->param->model[1]))
587                 error = ENXIO;
588             if (error) {
589                 free(atadev->param, M_ATA);

(gdb) l *ata_identify_devices+0x5f
0xc045d8ff is in ata_identify_devices (../../../dev/ata/ata-all.c:637).
632             else
633                 ch->device[SLAVE].attach = ad_attach;
634     #endif
635         }
636         if (ch->devices & ATA_ATAPI_SLAVE) {
637             if (ata_getparam(&ch->device[SLAVE], ATA_ATAPI_IDENTIFY))
638                 ch->devices &= ~ATA_ATAPI_SLAVE;
639             else {
640                 switch (ch->device[SLAVE].param->config & ATA_ATAPI_TYPE_MASK) {
641     #ifdef DEV_ATAPICD

(gdb) l *ata_boot_attach+0x2f
0xc045dcdf is in ata_boot_attach (../../../dev/ata/ata-all.c:742).
737          */
738         for (ctlr=0; ctlr<devclass_get_maxunit(ata_devclass); ctlr++) {
739             if (!(ch = devclass_get_softc(ata_devclass, ctlr)))
740                 continue;
741             ata_identify_devices(ch);
742             if (ch->device[MASTER].attach)
743                 ch->device[MASTER].attach(&ch->device[MASTER]);
744             if (ch->device[SLAVE].attach)
745                 ch->device[SLAVE].attach(&ch->device[SLAVE]);
746     #ifdef DEV_ATAPICAM