(unknown charset) Repeatable, reproducible, and random panics when ripping a CD

(Continuation of split thread from a few days ago.)

I've rebooted into a -CURRENT from this morning, patching manually for the
ULE/preemption disagreement.  Wondering if the ithread fixup from earlier
this week would have any bearing on my panics (as some of them had something
to do with ithread), I tried again, and retrieved yet another panic -- this
time somewhere in ACPI.

Here's the crash.  I'll refrain from producing any more panics to avoid
confusion, but am willing to dig into this further if asked.

Before the crash, I received a large number of SCSI TRANSPORT errors -- I'm
ripping through cd(4) devices.  I believe I still get a crash if I rip
through acd(4) devices.

----

# gdb6 -k kernel.debug /var/crash/vmcore.0 
GNU gdb 20040615 [GDB v6.x for FreeBSD]
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i386-portbld-freebsd5.2"...
panic messages:
---
Fatal trap 12: page fault while in kernel mode
cpuid = 1; apic id = 01
fault virtual address   = 0x66
fault code              = supervisor read, page not present
instruction pointer     = 0x8:0xc046258e
stack pointer           = 0x10:0xd3f3eb14
frame pointer           = 0x10:0xd3f3eb34
code segment            = base 0x0, limit 0xfffff, type 0x1b
                        = DPL 0, pres 1, def32 1, gran 1
processor eflags        = interrupt enabled, resume, IOPL = 0
current process         = 46 (acpi_thermal)
kernel: type 12 trap, code=0    
Dumping 511 MB                  
 16 32 48 64 80 96 112 128 144 160 176 192 208 224 240 256 272 288 304 320 336 352 368 384 400 416 432 448 464 480 496
---                             
#0  doadump () at /usr/src/sys/kern/kern_shutdown.c:236
236             dumping++;      
doadump () at /usr/src/sys/kern/kern_shutdown.c:236
236             dumping++;      
(kgdb) backtrace                
#0  doadump () at /usr/src/sys/kern/kern_shutdown.c:236
#1  0xc048380e in db_fncall (dummy1=1936, dummy2=0, dummy3=0, dummy4=0xd3f3e930 "Ï\a") at /usr/src/sys/ddb/db_command.c:551
#2  0xc04834ce in db_command (last_cmdp=0xc07bcb70, cmd_table=0x0, aux_cmd_tablep=0xc078339c, aux_cmd_tablep_end=0xc07833a0) at /usr/src/sys/ddb/db_command.c:348
#3  0xc0483713 in db_command_loop () at /usr/src/sys/ddb/db_command.c:475
#4  0xc048636a in db_trap (type=12, code=0) at /usr/src/sys/ddb/db_trap.c:73
#5  0xc0701351 in kdb_trap (type=12, code=0, regs=0xd3f3ead4) at /usr/src/sys/i386/i386/db_interface.c:159
#6  0xc0716fff in trap_fatal (frame=0xd3f3ead4, eva=0) at /usr/src/sys/i386/i386/trap.c:810
#7  0xc0716cae in trap_pfault (frame=0xd3f3ead4, usermode=0, eva=102) at /usr/src/sys/i386/i386/trap.c:733
#8  0xc07168ef in trap (frame=  
      {tf_fs = -739049448, tf_es = -739049456, tf_ds = -739049456, tf_edi = 36803, tf_esi = -1046789344, tf_ebp = -738989260, tf_isp = -738989312, tf_ebx = 100, tf_edx = 100, tf_ecx = 0, tf_eax = 100, tf_trapno = 12, tf_err = 0, tf_eip = -1069144690, tf_cs = 8, tf_eflags = 66050, tf_esp = 0, tf_ss = -1046789344}) at /usr/src/sys/i386/i386/trap.c:420
#9  0xc0702b9a in calltrap () at /usr/src/sys/i386/i386/exception.s:140
#10 0xd3f30018 in ?? ()         
#11 0xd3f30010 in ?? ()         
#12 0xd3f30010 in ?? ()         
#13 0x00008fc3 in ?? ()         
#14 0xc19b4320 in ?? ()         
#15 0xd3f3eb34 in ?? ()         
#16 0xd3f3eb00 in ?? ()         
#17 0x00000064 in ?? ()         
#18 0x00000064 in ?? ()         
#19 0x00000000 in ?? ()         
#20 0x00000064 in ?? ()         
#21 0x0000000c in ?? ()         
#22 0x00000000 in ?? ()         
#23 0xc046258e in AcpiNsDeleteNamespaceByOwner (OwnerId=36803) at /usr/src/sys/contrib/dev/acpica/nsalloc.c:748
#24 0xc04543d8 in AcpiDsTerminateControlMethod (WalkState=0xc1a5b000) at /usr/src/sys/contrib/dev/acpica/dsmethod.c:679
#25 0xc046616a in AcpiPsParseAml (WalkState=0xc1a5b000) at /usr/src/sys/contrib/dev/acpica/psparse.c:1355
#26 0xc0466bfc in AcpiPsxExecute (Info=0xd3f3ec44) at /usr/src/sys/contrib/dev/acpica/psxface.c:288
#27 0xc04628b9 in AcpiNsExecuteControlMethod (Info=0xd3f3ec44) at /usr/src/sys/contrib/dev/acpica/nseval.c:518
#28 0xc046284c in AcpiNsEvaluateByHandle (Info=0xd3f3ec44) at /usr/src/sys/contrib/dev/acpica/nseval.c:418
#29 0xc04626dd in AcpiNsEvaluateRelative (Pathname=0x0, Info=0xd3f3ec44) at /usr/src/sys/contrib/dev/acpica/nseval.c:229
#30 0xc046411b in AcpiEvaluateObject (Handle=0xc19b8c40, Pathname=0xc075506a "_TMP", ExternalParams=0x0, ReturnBuffer=0xd3f3ec78) at /usr/src/sys/contrib/dev/acpica/nsxfeval.c:363
#31 0xc0488a04 in acpi_GetInteger (handle=0xc19b8c40, path=0xc075506a "_TMP", number=0xd3f3ecd4) at /usr/src/sys/dev/acpica/acpi.c:1528
#32 0xc04940c5 in acpi_tz_monitor (Context=0xc1a44a00) at /usr/src/sys/dev/acpica/acpi_thermal.c:403
#33 0xc0494944 in acpi_tz_thread (arg=0x0) at /usr/src/sys/dev/acpica/acpi_thermal.c:799
#34 0xc0520ffb in fork_exit (callout=0xc049486b <acpi_tz_thread>, arg=0x0, frame=0x0) at /usr/src/sys/kern/kern_fork.c:815
#35 0xc0702bfc in fork_trampoline () at /usr/src/sys/i386/i386/exception.s:209
(kgdb) list *0xc046258e         
0xc046258e is in AcpiNsDeleteNamespaceByOwner (/usr/src/sys/contrib/dev/acpica/nsalloc.c:750).
745                 DeletionNode = NULL;
746             }               
747     
748             if (ChildNode)
749             {
750                 if (ChildNode->OwnerId == OwnerId)
751                 {
752                     /* Found a matching child node - detach any attached object */
753     
754                     AcpiNsDetachObject (ChildNode);
(kgdb)