if_ndis related panic in propagate_priority

Hi,

lately I'm seeing random panics when loading the if_ndis module, sometimes
right after loading it, sometimes quite some time later.

Kernel is from Sun Mar 28 20:41:32 CEST 2004, the card is an Intel P/W LAN
2100 3B.

Messages leading up to the panic:

---8<---
ndis0: <Intel(R) PRO/Wireless LAN 2100 3B Mini PCI Adapter> mem 0xc0200000-0xc0200fff irq 6 at device 2.0 on pci2
ndis0: [GIANT-LOCKED]
can't re-use a leaf (ESS_ID)!
ndis0: NDIS API version: 5.1
ndis0: Ethernet address: 00:04:23:7e:d9:98
ndis0: 11b rates: 11Mbps 2Mbps 1Mbps
kernel trap 12 with interrupts disabled


Fatal trap 12: page fault while in kernel mode
cpuid = 0; apic id = 00
fault virtual address   = 0x24
fault code              = supervisor read, page not present
instruction pointer     = 0x8:0xc04f2bd4
stack pointer           = 0x10:0xd7249cac
frame pointer           = 0x10:0xd7249cbc
code segment            = base 0x0, limit 0xfffff, type 0x1b
                        = DPL 0, pres 1, def32 1, gran 1
processor eflags        = resume, IOPL = 0
current process         = 17 (irq6: ndis0)
kernel: type 12 trap, code=0
---8<--


Backtrace:

---8<---
#0  doadump () at /usr/src/sys/kern/kern_shutdown.c:240
#1  0xc0442ba6 in db_fncall (dummy1=0x0, dummy2=0x0, dummy3=0xc067a314,
    dummy4=0xd7249b14 "_at_3iÀH\233$×n$]ÀH\233$×Û$]À\220\a") at /usr/src/sys/ddb/db_command.c:551
#2  0xc04429ac in db_command (last_cmdp=0xc06618e0, cmd_table=0x0, aux_cmd_tablep=0xc06325bc,
    aux_cmd_tablep_end=0xc06325c0) at /usr/src/sys/ddb/db_command.c:348
#3  0xc0442a8c in db_command_loop () at /usr/src/sys/ddb/db_command.c:475
#4  0xc0445229 in db_trap (type=0xc, code=0x0) at /usr/src/sys/ddb/db_trap.c:73
#5  0xc05d89f9 in kdb_trap (type=0xc, code=0x0, regs=0xd7249c6c) at /usr/src/sys/i386/i386/db_interface.c:172
#6  0xc05eac1f in trap_fatal (frame=0xd7249c6c, eva=0x24) at /usr/src/sys/i386/i386/trap.c:810
#7  0xc05ea3dd in trap (frame=
      {tf_fs = 0xc1570018, tf_es = 0xd7240010, tf_ds = 0xc04e0010, tf_edi = 0x0, tf_esi = 0xc157ee70, tf_ebp = 0xd7249cbc, tf_isp = 0xd7249c98, tf_ebx = 0xc157e000, tf_edx = 0xc0669720, tf_ecx = 0xc157ee70, tf_eax = 0x10, tf_trapno = 0xc, tf_err = 0x0, tf_eip = 0xc04f2bd4, tf_cs = 0x8, tf_eflags = 0x10093, tf_esp = 0x10, tf_ss = 0xc41bd2a0})
    at /usr/src/sys/i386/i386/trap.c:250
#8  0xc04f2bd4 in propagate_priority (td=0xc157e000) at /usr/src/sys/kern/subr_turnstile.c:225
#9  0xc04f3320 in turnstile_wait (ts=0xc41aa1c0, lock=0xc0669720, owner=0xc157e000)
    at /usr/src/sys/kern/subr_turnstile.c:505
#10 0xc04c806d in _mtx_lock_sleep (m=0xc0669720, opts=0x0, file=0x0, line=0x0) at /usr/src/sys/kern/kern_mutex.c:536
#11 0xc04beb75 in ithread_loop (arg=0xc3fcc880) at /usr/src/sys/kern/kern_intr.c:545
#12 0xc04bdc61 in fork_exit (callout=0xc04bea48 <ithread_loop>, arg=0xc3fcc880, frame=0xd7249d48)
    at /usr/src/sys/kern/kern_fork.c:819
---8<---

cheers,
le

-- 
Lukas Ertl                           http://mailbox.univie.ac.at/~le/
le_at_FreeBSD.org                       http://people.freebsd.org/~le/