Re: uipc_socket2.c panic

The crash process this way:
one of my ssh connections (always the same out of two) is reseted with
message about incorrect packet lenght (the length is incredibly big
number) then it panics..

I have another bt (from kern_mbuf.c vers. 1.2)

necrophilia NEOLOGISM# gdb -k kernel.debug /var/crash/vmcore.4
GNU gdb 5.2.1 (FreeBSD)
Copyright 2002 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i386-undermydesk-freebsd"...
panic: sbflush: cc 304 || mb 0 || mbcnt 0
panic messages:
---
panic: sbflush: cc 304 || mb 0 || mbcnt 0
at line 891 in file /usr/src/sys/kern/uipc_socket2.c
Debugger("panic")
Dumping 95 MB
 16 32 48 64 80
---
Reading symbols from /boot/kernel/if_ep.ko...done.
Loaded symbols for /boot/kernel/if_ep.ko
Reading symbols from /usr/obj/usr/src/sys/NEOLOGISM/modules/usr/src/sys/modules/
elink/elink.ko.debug...done.
Loaded symbols for /usr/obj/usr/src/sys/NEOLOGISM/modules/usr/src/sys/modules/el
ink/elink.ko.debug
#0  doadump () at /usr/src/sys/kern/kern_shutdown.c:236
236             dumping++;
(kgdb) bt
#0  doadump () at /usr/src/sys/kern/kern_shutdown.c:236
#1  0xc044c975 in db_fncall (dummy1=0, dummy2=0, dummy3=0,
    dummy4=0xc70dea40 "`ľgŔ¨6jŔ\\ę\rÇ\r") at /usr/src/sys/ddb/db_command.c:551
#2  0xc044c6b2 in db_command (last_cmdp=0xc067ac00, cmd_table=0x0,
    aux_cmd_tablep=0xc0650ccc, aux_cmd_tablep_end=0xc0650cd0)
    at /usr/src/sys/ddb/db_command.c:348
#3  0xc044c805 in db_command_loop () at /usr/src/sys/ddb/db_command.c:475
#4  0xc044f9b5 in db_trap (type=3, code=0) at /usr/src/sys/ddb/db_trap.c:73
#5  0xc0604a2c in kdb_trap (type=3, code=0, regs=0xc70deb8c)
    at /usr/src/sys/i386/i386/db_interface.c:159
#6  0xc061546c in trap (frame=
      {tf_fs = -1057947624, tf_es = 16, tf_ds = 16, tf_edi = 1, tf_esi = -106718
9840, tf_ebp = -955388968, tf_isp = -955389000, tf_ebx = 0, tf_edx = 0, tf_ecx =
 -1061076992, tf_eax = 18, tf_trapno = 3, tf_err = 0, tf_eip = -1067430684, tf_c
s = 8, tf_eflags = 646, tf_esp = -1067135921, tf_ss = -1067201382})
    at /usr/src/sys/i386/i386/trap.c:579
#7  0xc0604ce4 in Debugger (msg=0x0) at machine/cpufunc.h:56
#8  0xc04cdc45 in __panic (file=0xc063f957 "/usr/src/sys/kern/uipc_socket2.c",
    line=891, fmt=0xc063f9b0 "sbflush: cc %u || mb %p || mbcnt %u")
    at /usr/src/sys/kern/kern_shutdown.c:532
#9  0xc05130f1 in sbflush (sb=0xc70dec5c)
    at /usr/src/sys/kern/uipc_socket2.c:891
#10 0xc05127f4 in sbrelease (sb=0xc70dec5c, so=0x0)
    at /usr/src/sys/kern/uipc_socket2.c:466
---Type <return> to continue, or q <return> to quit---
#11 0xc0510942 in sorflush (so=0xc0f96c64)
    at /usr/src/sys/kern/uipc_socket.c:1238
#12 0xc051084f in soshutdown (so=0xc0f96c64, how=2)
    at /usr/src/sys/kern/uipc_socket.c:1207
#13 0xc0515c48 in shutdown (td=0x0, uap=0xc0f96c64)
    at /usr/src/sys/kern/uipc_syscalls.c:1285
#14 0xc0615eb0 in syscall (frame=
      {tf_fs = 671809583, tf_es = 47, tf_ds = -1078001617, tf_edi = 134680576, t
f_esi = -1077943008, tf_ebp = -1077943032, tf_isp = -955388556, tf_ebx = 6718607
12, tf_edx = 0, tf_ecx = 0, tf_eax = 134, tf_trapno = 0, tf_err = 2, tf_eip = 67
3485263, tf_cs = 31, tf_eflags = 582, tf_esp = -1077943060, tf_ss = 47})
    at /usr/src/sys/i386/i386/trap.c:1004
#15 0x282491cf in ?? ()
---Can't read userspace from dump, or kernel process---

(kgdb)