panic: splay lookup failed in remove

I ran 4 fsx instances in parallel on a dual-cpu machine with
mpsafevfs=1 and up-to-date sources, and it panicked after a few
seconds with:

panic: splay lookup failed in remove
cpuid = 1
KDB: enter: panic
[thread pid 3 tid 100121 ]
Stopped at      kdb_enter+0x30: leave
db> tr
Tracing pid 3 tid 100121 td 0xc570c170
kdb_enter(c06fb771,1,c0704ec6,eec1eac4,c570c170) at kdb_enter+0x30
panic(c0704ec6,0,22,de81406c,c5a5a9f4) at panic+0x13e
buf_vlist_remove(de71cab4,0,c0704cf2,572,de71cab4) at buf_vlist_remove+0x94
brelvp(de71cab4,0,4e6,c0703728,de71cab4) at brelvp+0xbe
brelse(de71cab4,c0703392,c72,c0703c55,de71cab4) at brelse+0x1ed
bufdone(de71cab4,0,c0703392,3c6) at bufdone+0x59c
vfs_backgroundwritedone(de71cab4,0,c0703392,c84,de71cab4) at vfs_backgroundwritedone+0x13f
bufdone(de71cab4,bdb,0,cc12b18c,cc12b18c) at bufdone+0x1c7
g_vfs_done(cc12b18c,0,c0703392,bdb) at g_vfs_done+0xa2
biodone(cc12b18c,c06f63e0,1e8,c06f67c1,cc12b18c) at biodone+0x72
g_io_schedule_up(c570c170,0,c06f68ac,5d,0) at g_io_schedule_up+0x1a2
g_up_procbody(0,eec1ed48,c06f8a14,30e,c570c170) at g_up_procbody+0x93
fork_exit(c04edba8,0,eec1ed48) at fork_exit+0x11b
fork_trampoline() at fork_trampoline+0x8
--- trap 0x1, eip = 0, esp = 0xeec1ed7c, ebp = 0 ---

Kris