CURRENT panics sometimes

Hi.

	1 boot of 3 I got similar panics in softclock().

kernel trap 12 with interrupts disabled


Fatal trap 12: page fault while in kernel mode
cpuid = 0; apic id = 00
fault virtual address   = 0x218
fault code              = supervisor read, page not present
instruction pointer     = 0x20:0xc06aa6ae
stack pointer           = 0x28:0xd4710cac
frame pointer           = 0x28:0xd4710cd4
code segment            = base 0x0, limit 0xfffff, type 0x1b
                         = DPL 0, pres 1, def32 1, gran 1
processor eflags        = resume, IOPL = 0
current process         = 13 (swi4: clock sio)

	The trace is:

softclock(0) ... +0x86
ithread_execute_handlers
ithread_loop
fork_exit
form_trampoline

	softclock+0x86 is here (marked with an arrow)

		/*
		 * softticks may be modified by hard clock, so cache
		 * it while we work on a given bucket.
		 */
		curticks = softticks;
		bucket = &callwheel[curticks & callwheelmask];
		c = TAILQ_FIRST(bucket);
		while (c) {
			depth++;
--->			if (c->c_time != curticks) {
				c = TAILQ_NEXT(c, c_links.tqe);
				++steps;

	Debugging shows that 'c' has the value of 0x210. Which is incorrect for 
sure. 'c_time' has an offset of 0x8, giving us fault virtual address.
	I'm using NDIS. It seems, that panic happens on first packet NDIS tries 
to send. This is when 'ntpdate' is being run at boot stage.
	As I said, I can reproduce it by rebooting a few times. Can anyone give 
a clue where to look in DDB further to help to resolve this problem?

-- 
Maxim Maximov