panic: Duplicate free of item 0xc433e420 from zone 0xc1045c00(g_bio)

I got another panic.  This time I got a clean core-dump, and I also
have a kernel with all the debugging symbols if that would help.
Here is some of the info.  The system had been up about 18 hours
before the panic.  The system was basically idle at the time of the
panic.  This is a snapshot of current which I started to build at
about 2pm EST on January 20th.

Note that I have no idea when those WRITE_DMA messages came out, so
I do not know if they are related to the panic, or if those messages
were written hours earlier.

Let me know if anyone wants to pursue this further.

ad4: TIMEOUT - WRITE_DMA retrying (2 retries left) LBA=42098457
ad4: TIMEOUT - WRITE_DMA retrying (2 retries left) LBA=42098457
ad4: FAILURE - WRITE_DMA timed out

g_vfs_done():ad4s2d[WRITE(offset=320405504, length=16384)]error = 5
Slab at 0xc433ef70, freei 8 = 0.
panic: Duplicate free of item 0xc433e420 from zone 0xc1045c00(g_bio)

KDB: enter: panic
[thread pid 3 tid 100044 ]
Stopped at      kdb_enter+0x2b: nop

db> call doadump()
Dumping 959 MB
  16 32 48 64 80 96 112 128 144 160 176 192 208 224 240 256 272 288 
304 320 336 3
52 368 384 400 416 432 448 464 480 496 512 528 544 560 576 592 608 
624 640 656 6
72 688 704 720 736 752 768 784 800 816 832 848 864 880 896 912 928 944
Dump complete
0xf

db> trace
Tracing pid 3 tid 100044 td 0xc21da5c0
kdb_enter(c0696bbb) at kdb_enter+0x2b
panic(c06a9988,c433e420,c1045c00,c0691d35,c06a996c) at panic+0xbb
uma_dbg_free(c1045c00,0,c433e420) at uma_dbg_free+0x110
uma_zfree_arg(c1045c00,c433e420,0) at uma_zfree_arg+0xf3
g_destroy_bio(c433e420,c433e420,c223f800,e3c0ccd4,c053d2a3) at 
g_destroy_bio+0x13
g_disk_done(c433e420) at g_disk_done+0x62
biodone(c433e420,c24b2198,e3c0ccf8,c0461e92,c24b2198) at biodone+0x57
ad_done(c24b2198) at ad_done+0x2d
ata_completed(c24b2198,c06f3320) at ata_completed+0x376
g_io_schedule_up(c21da5c0) at g_io_schedule_up+0x31
g_up_procbody(0,e3c0cd48,0,c04c99d8,0) at g_up_procbody+0x5a
fork_exit(c04c99d8,0,e3c0cd48) at fork_exit+0xa4
fork_trampoline() at fork_trampoline+0x8
--- trap 0x1, eip = 0, esp = 0xe3c0cd7c, ebp = 0 ---

-- 
Garance Alistair Drosehn            =   gad_at_gilead.netel.rpi.edu
Senior Systems Programmer           or  gad_at_freebsd.org
Rensselaer Polytechnic Institute    or  drosih_at_rpi.edu