panic --- Memory modified after free

Trying to mount root from ufs:/dev/ad0s3a
Memory modified after free 0xc1bcba00 (508)  val = ff70ff70 _at_ 0xc1bcba00

Fatal trap 12: page fault while in kernel mode
fault virtual address     = 0xff70ff90
fault code                = supervisor read, page not present
instruction pointer       = 0x8:0xc05f8b79
stack pointer             = 0x10:0xd539b964
frame pointer             = 0x10:0xd539b984
code segement             = base 0x0, limit 0xfffff, type 0x1b
                          = DPL 0, pres 1, def32 1, gran 1
processor eflages         = interrupt enabled, resume, IOPL = 0
current process           = 52 (sh)
[thread pid 52 tid 100040]
Stopped at mtrash_ctor+0x51:   movl  0x20(%eax),%edx

db> trace
mtrash_ctor(c1bcba00,200,0,2) at mtrash_ctor+0x51
uma_zalloc_arg(c10456c0,0,2) at uma_zalloc_arg+0x3c0
malloc(188,c069dc60,2,c069f384,c1a39070) at malloc+0x6b
elf32_load_file(d539baa8,d539bbd0,100) at elf32_load_file+0x40
exec_elf32_imgact(d539bb94) at exec_elf32_imgact+0x413
kern_execve(c1a39000,8077538,807756c,807757c,0) at kern_execve+0x3fa
execve(c1a39000,d539bd14,3,0,282) at execve+0x18
syscall(2f,2f,2f,8077538,807756c) at syscall+0x128
Xint0x80_syscall() at Xint0x80_syscall+0x1f
--- syscall (59, FreeBSD ELF32, execve), eip = 0x48133f33, esp = 0xbfbfe4cc, ebp = bfbfe4f8

-- 
Steve