panic: Duplicate free of item 0xffffff002ef51d00 from zone 0xffffff003ffdc840(mbuf_packet)

Hey,

On an amd64 -CURRENT from yesterday I get this panic (now twice)
shortly after the system has come up in multi user.  It seems related
to sk(4) which is the active NIC in the system, but it might be the
problem is elsewhere.

It's currently running OK again on an kernel from Aug 19.  dmesg from
this old kernel attached.  I can generate dmesg from the new kernel if
needed.

Anybody has any ideas of what's going wrong?  I can test patches
etc. if needed.

gdb says:

Unread portion of the kernel message buffer:
Slab at 0xffffff002ef51f50, freei 13 = 0.
panic: Duplicate free of item 0xffffff002ef51d00 from zone 0xffffff003ffdc840(mbuf_packet)

cpuid = 0
KDB: enter: panic
Physical memory: 1012 MB
Dumping 203 MB: 188 172 156 140 124 108 92 76 60 44 28 12

#0  doadump () at pcpu.h:172
172     pcpu.h: No such file or directory.
        in pcpu.h
(kgdb) bt
#0  doadump () at pcpu.h:172
#1  0xffffffff801af2d4 in db_fncall (dummy1=0, dummy2=0, dummy3=0, dummy4=0x0)
    at /usr/src/sys/ddb/db_command.c:481
#2  0xffffffff801af689 in db_command_loop () at /usr/src/sys/ddb/db_command.c:396
#3  0xffffffff801b1553 in db_trap (type=-1603201104, code=0) at /usr/src/sys/ddb/db_main.c:221
#4  0xffffffff80450ac8 in kdb_trap (type=3, code=0, tf=0xffffffffa0711930)
    at /usr/src/sys/kern/subr_kdb.c:502
#5  0xffffffff806352c2 in trap (frame=
      {tf_rdi = 0, tf_rsi = -2132733952, tf_rdx = 1, tf_rcx = 1058292, tf_r8 = 1048064, tf_r9 = 10, tf_rax = 18, tf_rbx = -2139976232, tf_rbp = -1603200528, tf_r10 = -1603200768, tf_r11 = 10, tf_r12 = 0, tf_r13 = 256, tf_r14 = -1098480768320, tf_r15 = -1098438031296, tf_trapno = 3, tf_addr = 0, tf_flags = 256, tf_err = 0, tf_rip = -2142960273, tf_cs = 8, tf_rflags = 646, tf_rsp = -1603200528, tf_ss = 16})
    at /usr/src/sys/amd64/amd64/trap.c:471
#6  0xffffffff8061fb4b in calltrap () at /usr/src/sys/amd64/amd64/exception.S:168
#7  0xffffffff8045056f in kdb_enter (msg=0x0) at cpufunc.h:63
#8  0xffffffff8042b659 in panic (fmt=0xffffffff80728dd8 "Duplicate free of item %p from zone %p(%s)\n")
    at /usr/src/sys/kern/kern_shutdown.c:549
#9  0xffffffff805b5f08 in uma_dbg_free (zone=0xffffff003ffdc840, slab=0xffffff002ef51f50, 
    item=0xffffff002ef51d00) at /usr/src/sys/vm/uma_dbg.c:302
#10 0xffffffff805b3dc0 in uma_zfree_arg (zone=0xffffff003ffdc840, item=0xffffff002ef51d00, udata=0x0)
    at /usr/src/sys/vm/uma_core.c:2269
#11 0xffffffff804785b8 in m_freem (mb=0x12) at mbuf.h:445
#12 0xffffffff80359d53 in sk_txeof (sc_if=0xffffffff80e56000) at /usr/src/sys/dev/sk/if_sk.c:3233
#13 0xffffffff8035bc48 in sk_intr (xsc=0x0) at /usr/src/sys/dev/sk/if_sk.c:3459
#14 0xffffffff8041364e in ithread_loop (arg=0xffffff0000e8b020) at /usr/src/sys/kern/kern_intr.c:662
#15 0xffffffff8041229a in fork_exit (callout=0xffffffff80413550 <ithread_loop>, arg=0xffffff0000e8b020, 
    frame=0xffffffffa0711c90) at /usr/src/sys/kern/kern_fork.c:818
#16 0xffffffff8061feae in fork_trampoline () at /usr/src/sys/amd64/amd64/exception.S:394
#17 0x0000000000000000 in ?? ()
#18 0x0000000000000000 in ?? ()

-- 
Simon L. Nielsen