CURRENT unusable again, too many panics

Hi all,

In 9 from 10 boots I get the panic below. If I remove everything
from /tmp/vi.recover the box is bootable again. It looks like vi.recover
triggers a bug in the vm_system.

Anybody has some idea ?

A kernel from June works fine. RELENG_6 works fine.

A fresh kernel from today shows:

Unread portion of the kernel message buffer:
<118>Configuring syscons:
<118> keymap
panic: vm_page_free_toq: freeing mapped page 0xc2eb1eb8
cpuid = 0
KDB: enter: panic
panic: from debugger
cpuid = 0
Uptime: 42s
Physical memory: 2035 MB
Dumping 78 MB: 63 47 31 15

(kgdb) where
#0  doadump () at pcpu.h:166
#1  0xc06a15b0 in boot (howto=260) at /usr/src/sys/kern/kern_shutdown.c:409
#2  0xc06a18c5 in panic (fmt=0xc08e884b "from debugger") at 
/usr/src/sys/kern/kern_shutdown.c:565
#3  0xc0475ee6 in db_panic (addr=-1066666149, have_addr=0, count=-1, 
modif=0xe539d7c8 "") at /usr/src/sys/ddb/db_command.c:428
#4  0xc0475e7f in db_command (last_cmdp=0xc09fc3e4, cmd_table=0x0) at 
/usr/src/sys/ddb/db_command.c:396
#5  0xc0475f3a in db_command_loop () at /usr/src/sys/ddb/db_command.c:448
#6  0xc0477b39 in db_trap (type=3, code=0) at /usr/src/sys/ddb/db_main.c:221
#7  0xc06bfa34 in kdb_trap (type=3, code=0, tf=0xe539d958) at 
/usr/src/sys/kern/subr_kdb.c:502
#8  0xc08a0fb4 in trap (frame=
       {tf_fs = -449249272, tf_es = -1066663896, tf_ds = -1064173528, tf_edi = 
-1064023194, tf_esi = 1, tf_ebp = -449193576, tf_isp = -449193596, tf_ebx = 
-449193532, tf_edx = 0, tf_ecx = -1052561408, tf_eax = 18, tf_trapno = 3, tf_err 
= 0, tf_eip = -1066666149, tf_cs = 32, tf_eflags = 642, tf_esp = -449193544, 
tf_ss = -1066788745}) at /usr/src/sys/i386/i386/trap.c:620
#9  0xc088be3a in calltrap () at /usr/src/sys/i386/i386/exception.s:138
#10 0xc06bf75b in kdb_enter (msg=0x12 <Address 0x12 out of bounds>) at 
cpufunc.h:60
#11 0xc06a1877 in panic (fmt=0xc0944b66 "vm_page_free_toq: freeing mapped page 
%p") at /usr/src/sys/kern/kern_shutdown.c:549
#12 0xc0805402 in vm_page_free_toq (m=0xc2eb1eb8) at 
/usr/src/sys/vm/vm_page.c:1087
#13 0xc08048e1 in vm_page_free (m=0xc2eb1eb8) at /usr/src/sys/vm/vm_page.c:470
#14 0xc08020ad in vm_object_terminate (object=0xc53a2a50) at 
/usr/src/sys/vm/vm_object.c:657
#15 0xc0801f85 in vm_object_deallocate (object=0xc53a2a50) at 
/usr/src/sys/vm/vm_object.c:590
#16 0xc07feb4c in vm_map_entry_delete (map=0xc14650a8, entry=0xc53750cc) at 
/usr/src/sys/vm/vm_map.c:2283
#17 0xc07fec80 in vm_map_delete (map=0xc14650a8, start=3242610856, 
end=3792687104) at /usr/src/sys/vm/vm_map.c:2372
#18 0xc07fc3a8 in kmem_free_wakeup (map=0xc14650a8, addr=3792416768, size=18) at 
/usr/src/sys/vm/vm_kern.c:467
#19 0xc0689126 in exec_free_args (args=0xe539dc60) at 
/usr/src/sys/kern/kern_exec.c:1055
#20 0xc0688ad7 in do_execve (td=0xc50fdd80, args=0xe539dc60, mac_p=0x0) at 
/usr/src/sys/kern/kern_exec.c:795
#21 0xc0687ee0 in kern_execve (td=0xc50fdd80, args=0xe539dc60, mac_p=0x0) at 
/usr/src/sys/kern/kern_exec.c:258
#22 0xc0687e4b in execve (td=0xc50fdd80, uap=0x12) at 
/usr/src/sys/kern/kern_exec.c:188
#23 0xc08a1802 in syscall (frame=
       {tf_fs = 59, tf_es = 59, tf_ds = 59, tf_edi = 0, tf_esi = 0, tf_ebp = 0, 
tf_isp = 0, tf_ebx = 0, tf_edx = 0, tf_ecx = 0, tf_eax = 0, tf_trapno = 0, 
tf_err = 0, tf_eip = 671410388, tf_cs = 51, tf_eflags = 514, tf_esp = 
-1077940784, tf_ss = 59})
     at /usr/src/sys/i386/i386/trap.c:1006
#24 0xc088be8f in Xint0x80_syscall () at /usr/src/sys/i386/i386/exception.s:191

Martin Blapp, <mb_at_imp.ch> <mbr_at_FreeBSD.org>
------------------------------------------------------------------
ImproWare AG, UNIXSP & ISP, Zurlindenstrasse 29, 4133 Pratteln, CH
Phone: +41 61 826 93 00 Fax: +41 61 826 93 01
PGP: <finger -l mbr_at_freebsd.org>
PGP Fingerprint: B434 53FC C87C FE7B 0A18 B84C 8686 EF22 D300 551E
------------------------------------------------------------------