Reproduceable panic on boot

>From this morning's sources, on an IBM ThinkPad T40p:

...
Mounting root from ufs:/dev/ad0s1a

Memory modified after free 0xc45c7800(508) val=1000100 _at_ 0xc45c7800


Fatal trap 12: page fault while in kernel mode
fault virtual address   = 0x1000120
fault code              = supervisor read, page not present
instruction pointer     = 0x8:0xc05a5ee6
stack pointer           = 0x10:0xd8651984
frame pointer           = 0x10:0xd86519a0
code segment            = base 0x0, limit 0xfffff, type 0x1b
                        = DPL 0, pres 1, def32 1, gran 1
processor eflags        = interrupt enabled, resume, IOPL = 0
current process         = 63 (sh)
kernel: type12 trap, code=0
Stopped at     mtrash_ctor+0x3a:       movl     0x20(%eax),%eax
db> trace
mtrash_ctor(c45c7800,200,0) at mtrash_ctor+0x3a
uma_zalloc_arg(c1045cc0,0,2) at uma_zalloc_arg+0x169
malloc(188,c062d800,2,3,c4467540) at malloc+0xb7
elf32_load_file(c4469370,d4e680f4,d8651ab0,d8651bd0,1000) at elf32_load_file+0x51
exec_elf32_imgact(d8651b94,c04dfee0,c065b7e8,0,0) at exec_elf32_imgact+0x4c7
kern_execve(c4467540,8065848,806587c,806588c,0) at kern_execve+0x386
execve(c4467540,d8651d14,3,0,282) at execve+0x18
syscall(2f,2f,2f,8065848,806587c) at syscall+0x217
Xint0x80_syscall() at Xint0x80_syscall+0x1d
--- syscall (59, FreeBSD ELF32, execve), eip = 0x2811cd87, esp = 0xbfbfe53c, ebp = 0xbfbfe568 ---

When I boot with no modules except ACPI, the panic occurs after:

ata1-slave: FAILURE - ATAPI_IDENTIFY no interrupt
Memory modified after free 0xc40a0a00(508) val=1000100 _at_ 0xc40a0a00

...

db> trace
mtrash_ctor(c40a0a00,200,0) at mtrash_ctor+0x3a
uma_zalloc_arg(c0c45cc0,0,1) at uma_zalloc_arg+0x169
malloc(200,c0624660,1,c,a11cb300) at malloc+0xb7
ata_getparam(c40a00a4,a1) at ata_getparam+0x30
ata_identify_devices(c40a0000) at ata_identify_devices+0x10a
ata_boot_attach(0) at ata_boot_attach+0x27
run_interrupt_driven_config_hooks(0,81ec00,81e000,0,c042adf5) at
run_interrupt_driven_config_hooks+0x18
mi_startup() at mi_startup+0x96
begin() at begin+0x2c