panic: Memory modified after free

The system is a dual proc Tyan K8S Pro with 12 GB of memory.
The kernel is UP.  This was recorded by hand. I have the crash dump.

Memory modified after free 0xffffff02505e0c00(504) val=deadc0dd _at_
0xffffff02505e0cd0

panic: Most recently used by DEVFS1
KDB: stack backtrace
kdb_backtrace() at kdb_backtrace+0x37
panic() at panic+0x164
mtrash_ctor() at mtrash_ctor+0x70
uma_zalloc_arg() at uma_zalloc_arg+0x170
malloc() at malloc+0xf5
fdinit() at fdinit+0x20
fdcopy() at fdcopy+0x21
fork1() at fork1+0x624
vfork() at vork+0x1f
syscall() at syscall+0x350
Xfast_syscall() at Xfast_syscall+0xa8

--- syscall(66, FreeBSD ELF64, vfork), rip = 0x2006aa6d, rsp=0x7ffffffdac0,
rbp = 0 ---

Hmmm....
troutmask:root[259] gdb /boot/kernel/kernel vmcore.0
GNU gdb 6.1.1 [FreeBSD]
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "amd64-marcel-freebsd"...

warning: "/usr/tmp/vmcore.0": no core file handler recognizes format, using defa
ult
Can't fetch registers from this type of core file
Can't fetch registers from this type of core file
#0  0x0000000000000000 in ?? ()


-- 
Steve