Kernel panic: "spec nodes went here" in 6.0-RC1

This may be a known issue, but I haven't found much discussion on  
it.  I'm playing with 6.0-RC1 and the kernel test suite.  Within  
minutes of running the suite I get a kernel panic: "spec nodes went  
here".  This seems to happen consistently.  The panic happens in  
ffsext_strategy(), but it looks like the arguments to the mkdir()  
system call are missing.

[GDB will not be able to debug user-mode threads: /usr/lib/ 
libthread_db.so: Undefined symbol "ps_pglobal_lookup"]
GNU gdb 6.1.1 [FreeBSD]
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and  
you are
welcome to change it and/or distribute copies of it under certain  
conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for  
details.
This GDB was configured as "i386-marcel-freebsd".

Unread portion of the kernel message buffer:
panic: spec nodes went here
Uptime: 56m52s
Dumping 254 MB (2 chunks)
   chunk 0: 1MB (159 pages) ... ok
   chunk 1: 255MB (65088 pages) 239 223 207 191 175 159 143 127 111  
95 79 63 47 31 15

#0  doadump () at pcpu.h:165
165    pcpu.h: No such file or directory.
     in pcpu.h
(kgdb) bt
#0  doadump () at pcpu.h:165
#1  0xc0637806 in boot (howto=260) at /usr/src/sys/kern/ 
kern_shutdown.c:399
#2  0xc0637a9c in panic (fmt=0xc0879536 "spec nodes went here")
     at /usr/src/sys/kern/kern_shutdown.c:555
#3  0xc0788988 in ffsext_strategy (ap=0xd16d39c0)
     at /usr/src/sys/ufs/ffs/ffs_vnops.c:1245
#4  0xc0816c79 in VOP_STRATEGY_APV (vop=0xc08fab60, a=0xd16d39c0)
     at vnode_if.c:1796
#5  0xc06813fc in bufstrategy (bo=0xc1fa01d0, bp=0x0) at vnode_if.h:928
#6  0xc067bfc4 in bufwrite (bp=0xc6650b60) at buf.h:415
#7  0xc0791bc9 in ufs_mkdir (ap=0xd16d3bb8) at buf.h:399
#8  0xc0816840 in VOP_MKDIR_APV (vop=0x0, a=0xd16d3bb8) at vnode_if.c: 
1251
#9  0xc0695c05 in kern_mkdir (td=0xc2889a80,
     path=0xbfbfac90 <Address 0xbfbfac90 out of bounds>,  
segflg=UIO_USERSPACE,
     mode=504) at vnode_if.h:653
#10 0xc06958e9 in mkdir (td=0xc2889a80, uap=0x0)
     at /usr/src/sys/kern/vfs_syscalls.c:3301
#11 0xc0807177 in syscall (frame=
       {tf_fs = 671416379, tf_es = -1078001605, tf_ds = -1078198213,  
tf_edi = 671416968, tf_esi = -1077941124, tf_ebp = -1077957512,  
tf_isp = -781370012, tf_ebx = 1, tf_edx = -1077957485, tf_ecx = 0,  
tf_eax = 136, tf_trapno = 12, tf_err = 2, tf_eip = 671841683, tf_cs =  
51, tf_eflags = 658, tf_esp = -1077958580, tf_ss = 59}) at /usr/src/ 
sys/i386/i386/trap.c:976
#12 0xc07f605f in Xint0x80_syscall () at /usr/src/sys/i386/i386/ 
exception.s:200
---Type <return> to continue, or q <return> to quit---
#13 0x00000033 in ?? ()
Previous frame inner to this frame (corrupt stack?)
(kgdb) f 3
#3  0xc0788988 in ffsext_strategy (ap=0xd16d39c0)
     at /usr/src/sys/ufs/ffs/ffs_vnops.c:1245
1245        panic("spec nodes went here");
(kgdb) l
1240        if (VTOI(vp)->i_fs->fs_magic == FS_UFS2_MAGIC &&
1241            lbn < 0 && lbn >= -NXADDR)
1242            return (VOP_STRATEGY_APV(&ufs_vnodeops, ap));
1243        if (vp->v_type == VFIFO)
1244            return (VOP_STRATEGY_APV(&ufs_fifoops, ap));
1245        panic("spec nodes went here");
1246    }
1247
1248    /*
1249     * Vnode extattr transaction commit/abort
(kgdb) p *vp
$1 = {v_type = VDIR, v_tag = 0xc086a45a "ufs", v_op = 0xc08fab60,
   v_data = 0xc2446bdc, v_mount = 0xc16f7000, v_nmntvnodes = {
     tqe_next = 0xc1abb440, tqe_prev = 0xc1f08124}, v_un = {vu_mount  
= 0x0,
     vu_socket = 0x0, vu_cdev = 0x0, vu_fifoinfo = 0x0}, v_hashlist = {
     le_next = 0xc253abb0, le_prev = 0xc16a4f9c}, v_hash = 2873446,
   v_cache_src = {lh_first = 0x0}, v_cache_dst = {tqh_first = 0x0,
     tqh_last = 0xc1fa0140}, v_dd = 0x0, v_cstart = 0, v_lasta = 0,
   v_lastw = 0, v_clen = 0, v_lock = {lk_interlock = 0xc0920340,
     lk_flags = 262208, lk_sharecount = 0, lk_waitcount = 0,
     lk_exclusivecount = 1, lk_prio = 80, lk_wmesg = 0xc086a45a "ufs",
     lk_timo = 51, lk_lockholder = 0xc2889a80, lk_newlock = 0x0},
   v_interlock = {mtx_object = {lo_class = 0xc08c19c4,
       lo_name = 0xc086b7bb "vnode interlock",
       lo_type = 0xc086b7bb "vnode interlock", lo_flags = 196608,  
lo_list = {
         tqe_next = 0x0, tqe_prev = 0x0}, lo_witness = 0x0}, mtx_lock  
= 4,
     mtx_recurse = 0}, v_vnlock = 0xc1fa0168, v_holdcnt = 2,  
v_usecount = 1,
   v_iflag = 0, v_vflag = 4, v_writecount = 0, v_freelist = {
     tqe_next = 0xc2450660, tqe_prev = 0xc1f654f8}, v_bufobj = {
     bo_mtx = 0xc1fa018c, bo_clean = {bv_hd = {tqh_first = 0xc6650b60,
         tqh_last = 0xc6650b98}, bv_root = 0xc6650b60, bv_cnt = 1},  
bo_dirty = {
       bv_hd = {tqh_first = 0x0, tqh_last = 0xc1fa01e4}, bv_root = 0x0,
       bv_cnt = 0}, bo_numoutput = 1, bo_flag = 0, bo_ops = 0xc08c7864,
     bo_bsize = 16384, bo_object = 0x0, bo_synclist = {le_next = 0x0,
       le_prev = 0x0}, bo_private = 0xc1fa0110, __bo_vnode =  
0xc1fa0110},
---Type <return> to continue, or q <return> to quit---
   v_pollinfo = 0x0, v_label = 0x0}
(kgdb)

Erik Moe
emoe_at_cox.net