panic: negative nice count

Hi,

I'm running BETA6:

FreeBSD 82-168-140-74-bbxl.xdsl.tiscali.nl 5.3-BETA6 FreeBSD 5.3-BETA6 #0:
  Mon Sep 27 03:04:45 CEST 2004 root_at_82-168-140-74-bbxl.xdsl.tiscali.nl:
  /usr/obj/usr/src-releng_5/sys/RENE_2004-09-05d  i386

When I did "idprio 31 -<pid>" on a process with nice 20, I got a
"negative nice count" panic from kern_shutdown.c:553. I'm using ULE /
witness / no PREEMPTION

root_at_82-168-140-74-bbxl.xdsl.tiscali.nl:/usr/tmp/crashes#kgdb /boot/kernel.debug/.kernel.debug vmcore.1
[GDB will not be able to debug user-mode threads: /usr/lib/libthread_db.so: Undefined symbol "ps_pglobal_lookup"]
GNU gdb 6.1.1 [FreeBSD]
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i386-marcel-freebsd".
doadump () at pcpu.h:159
(kgdb) bt f
#0  doadump () at pcpu.h:159
No locals.
#1  0xc048f7b2 in boot (howto=260)
    at /usr/src-releng_5/sys/kern/kern_shutdown.c:397
	first_buf_printf = 1
#2  0xc048fb28 in panic (fmt=0xc05fa1ba "Negative nice count.")
    at /usr/src-releng_5/sys/kern/kern_shutdown.c:553
	td = (struct thread *) 0xc14b6000
	bootopt = 256
	newpanic = 1
	ap = 0xcee2dc58 "\001"
	buf = "Negative nice count.", '\0' <repeats 235 times>
#3  0xc04a1cab in kseq_nice_rem (kseq=0xc06452e0, nice=20)
    at /usr/src-releng_5/sys/kern/sched_ule.c:465
	n = 0
#4  0xc04a2924 in sched_class (kg=0xc1880150, class=4)
    at /usr/src-releng_5/sys/kern/sched_ule.c:1459
	kseq = (struct kseq *) 0xc06452e0
	ke = (struct td_sched *) 0x0
	td = (struct thread *) 0xc1882000
	nclass = 4
	oclass = 3
#5  0xc048d14f in rtp_to_pri (rtp=0xcee2dcd4, kg=0xc1880150)
    at /usr/src-releng_5/sys/kern/kern_resource.c:424
No locals.
#6  0xc048d03a in rtprio (td=0xc1880150, uap=0xcee2dd14)
    at /usr/src-releng_5/sys/kern/kern_resource.c:389
	curp = (struct proc *) 0x0
	p = (struct proc *) 0xc187f540
	kg = (struct ksegrp *) 0xc1880150
	rtp = {type = 4, prio = 31}
	cierror = 0
	error = 0
#7  0xc05d9130 in syscall (frame=
      {tf_fs = 47, tf_es = 47, tf_ds = 47, tf_edi = 134515411, tf_esi = -1077940737, tf_ebp = -1077941004, tf_isp = -823992972, tf_ebx = -1077940744, tf_edx = 0, tf_ecx = 639, tf_eax = 166, tf_trapno = 12, tf_err = 2, tf_eip = 671914111, tf_cs = 31, tf_eflags = 531, tf_esp = -1077941076, tf_ss = 47})
    at /usr/src-releng_5/sys/i386/i386/trap.c:1001
	params = 0xbfbfecb0 <Address 0xbfbfecb0 out of bounds>
	callp = (struct sysent *) 0xc061c530
	td = (struct thread *) 0xc14b6000
	p = (struct proc *) 0xc1680380
	orig_tf_eflags = 531
	sticks = 2
	error = 0
	narg = 3
	args = {1, 639, -1077941020, 2, -1050147968, 0, 0, 3}
	code = 166
#8  0xc05c7f9f in Xint0x80_syscall ()
    at /usr/src-releng_5/sys/i386/i386/exception.s:201
No locals.
#9  0x0000002f in ?? ()
No symbol table info available.
#10 0x0000002f in ?? ()
No symbol table info available.
#11 0x0000002f in ?? ()
No symbol table info available.
#12 0x08048ad3 in ?? ()
No symbol table info available.
#13 0xbfbfedff in ?? ()
No symbol table info available.
#14 0xbfbfecf4 in ?? ()
No symbol table info available.
#15 0xcee2dd74 in ?? ()
No symbol table info available.
#16 0xbfbfedf8 in ?? ()
No symbol table info available.
#17 0x00000000 in ?? ()
No symbol table info available.
#18 0x0000027f in ?? ()
No symbol table info available.
#19 0x000000a6 in ?? ()
No symbol table info available.
#20 0x0000000c in ?? ()
No symbol table info available.
#21 0x00000002 in ?? ()
No symbol table info available.
#22 0x280c987f in ?? ()
No symbol table info available.
#23 0x0000001f in ?? ()
No symbol table info available.
#24 0x00000213 in ?? ()
No symbol table info available.
#25 0xbfbfecac in ?? ()
No symbol table info available.
#26 0x0000002f in ?? ()
No symbol table info available.
#27 0x00000000 in ?? ()
No symbol table info available.
#28 0x00000000 in ?? ()
No symbol table info available.
#29 0x00000000 in ?? ()
No symbol table info available.
#30 0x00000000 in ?? ()
No symbol table info available.
#31 0x06e73000 in ?? ()
No symbol table info available.
#32 0xc14b6154 in ?? ()
No symbol table info available.
#33 0xc13e61a0 in ?? ()
No symbol table info available.
#34 0xcee2dc9c in ?? ()
No symbol table info available.
#35 0xcee2dc78 in ?? ()
No symbol table info available.
#36 0xc14b6000 in ?? ()
No symbol table info available.
#37 0xc04a2520 in sched_switch (td=0xbfbfedf8, newtd=0xbfbfedff, flags=Cannot access memory at address 0xbfbfed04
)
    at /usr/src-releng_5/sys/kern/sched_ule.c:1286
	ke = (struct td_sched *) 0x8048ad3
Previous frame inner to this frame (corrupt stack?)
(kgdb) q