[Panic] 6b3 + mdconfig -t malloc + unionfs + screeen

Hello.

Today, when trying to make this crappy legacy nVidia driver to work,
i managed to boot in single-user and i wanted screen(1) too.
I was afraid kldload nvidia.ko will panic my box, so i was planning
to do it while [most of] disks were mounted read-only.
(Yes nvidia.ko v.7xxx paniced it finally)
So i created following script, which _alone_ paniced my box.

...it loads snd_emu10k1 here... i really miss color beastie.
OK boot -vs
...dmesg (verbose) goes here...
...enter path name or /bin/sh:
# fsck -y
# mount -at ufs -o ro
# tcsh
> cat /ramfs.sh
#!/bin/sh
swapon -a
mount -uo rw /
mkdir /mnt/ramfs 2>&- 1>&-
mount -o ro -at ufs
mount -ufo ro -at ufs   # just to be sure
umount /mnt/ramfs 2>&- 1>&-
mdconfig -d -u 1
mdconfig -a -t malloc -s 16m -u 1
bsdlabel -w /dev/md1
newfs -O 1 -m 0 /dev/md1a
mount /dev/md1a /mnt/ramfs
mount_unionfs /mnt/ramfs /var
chmod 700 /tmp/screens/S-root
> /ramfs.sh
...newfs output goes here, with GEOM messages...
> pkg_info |grep screen
screen-4.0.2_1      A multi-screen window manager
> uname -a
FreeBSD Droid.local 6.0-BETA3 FreeBSD 6.0-BETA3 #3: Sun Sep  0
20:49:18 EEST 2005    
root_at_Droid.local:/usr/src/sys/i386/compile/Droid.debug  i386
> screen
panic: can't fifo/vnode bypass -1
KDB: enter: panic
[thread pid 146 tid 100053 ]
Stopped ad	kdb_enter+0x30: leave
db> trace
Tracing pid 146 tid 100057 td 0xc1932af0
kdb_enter(c07e4ddb,c085bb00,c07dc744,d52c8964,100) at panic+0x30
panic(c07dc744,ffffffff,c07dc716,11b,c1782d00) at panic+0xd5
fifo_open(d52c89e4,c1ae3dd0,d52c8bc4,c1a833d0,d52c8a10) at fifo_open+0x660
VOP_OPEN_APV(c083bba0,d52c89e4,c1932af0,d52c8a54,1) at VOP_OPEN_APV+0xac
union_open(d52c8a54,d52c8a04,d52c8bc4,0,d52c8b10) at union_open+0x8e
VOP_OPEN_APV(c1b35240,d52c8a54,267,c1932af0,1) at VOP_OPEN_APV+0xac
vn_open_cred(d52c8bc4,d52c8cc4,0,c1782d00,4) at vn_open_cred+0x472
vn_open(d52c8bc4,d52c8cc4,0,4,c08a7018,4) at vn_open+0x33
kern_open(c1932af0,808e220,0,5,0) at kern_open+0xc8
open(c1932af0,d52c8d04,c,422,3) at open+0x36
syscall(bfbf003b,3b,bfbf003b,4,3) at syscall+0x2c0
Xint0x80_syscall() at Xint0x80_syscall+0x1f
--- syscall(5, FreeBSD ELF32, open), eip = 0x28172e5f, esp =
0xbfbfe00c, ebp = 0xbfbfe158 ---
db> ps
pid	proc	uid	ppid	pgrp	flag	stat wmesg wchan cmd
146	c1a4720c  0	145	145	000002	[CPU 0] screen
145	c1a47000  0	73	145	0004002	[SLP0 pause 0xc1a47034][SLP] screen
138	c1921418  0	0	0	0000204	[SLP0 mdwait 0xc1a90000][SLP] md1
73	c1a47418  0	54	73	0004002 [SLP0 pause 0xc1a4744c][SLP] tcsh
54	c1a47624  0	1	54	0004002 [SLP0 wait 0xc1a47624][SLP] sh
...kernel threads here...
Panic was copied by hand - i have no serial console; but i can set up one.
Pleace advice me if i provided right information (or You need more).

The dmesg is on http://mclone.org.ua/~mclone/dmesg.6b3.txt
(they're from slightly older kernel; i'll reboot and replace ASAP)
Kernel config is here: http://mclone.org.ua/~mclone/Droid.debug
Nothing fancy (except verbose load) in /boot/loader.conf,
and i have only CPUTYPE?=i686 and WITH_OPT_PPRO=yes
in /etc/make.conf [coupled with various ports defines, that is].
-- 
wbr,                        |\      _,,,---,,_           dog bless ya!
`                       Zzz /,`.-'`'    -.  ;-;;,_
McLone at GMail dot com    |,4-  ) )-,_. ,\ (  `'-'
  net- and *BSD admin     '---''(_/--'  `-'\_)   ...sorry for translit