Panic on cardbus eject - ath(4)

Hi

I got the following panic ejecting my atheros based cardbus card.

ath0_at_pci4:0:0:  class=0x020000 card=0x3a121186 chip=0x0013168c rev=0x01 hdr=0x00
    vendor     = 'Atheros Communications Inc.'
    device     = 'AR5212, AR5213 802.11a/b/g Wireless Adapter'
    class      = network
    subclass   = ethernet
    cap 01[44] = powerspec 2  supports D0 D3  current D0


<5>ath0: link state changed to DOWN
ath0: detached


Fatal trap 12: page fault while in kernel mode
fault virtual address   = 0xc2b75654
fault code              = supervisor write, page not present
instruction pointer     = 0x20:0xc04dc302
stack pointer           = 0x28:0xd4e0caf0
frame pointer           = 0x28:0xd4e0cb08
code segment            = base 0x0, limit 0xfffff, type 0x1b
                        = DPL 0, pres 1, def32 1, gran 1
processor eflags        = interrupt enabled, resume, IOPL = 0
current process         = 314 (wpa_supplicant)
trap number             = 12
panic: page fault
KDB: stack backtrace:
db_trace_self_wrapper(c06748c3,d4e0c984,c04e852a,c0672dbc,c06d1e60,...) at db_tr
ace_self_wrapper+0x26
kdb_backtrace(c0672dbc,c06d1e60,c066656d,d4e0c990,d4e0c990,...) at kdb_backtrace
+0x29
panic(c066656d,c0687fb2,c2b9dcd4,1,1,...) at panic+0xaa
trap_fatal(c1054000,c2b75000,2,0,c0504095,...) at trap_fatal+0x353
trap_pfault(1,6ecfad6e,c,2de0ca30,c,...) at trap_pfault+0x25b
trap(d4e0cab0) at trap+0x392
calltrap() at calltrap+0x6
--- trap 0xc, eip = 0xc04dc302, esp = 0xd4e0caf0, ebp = 0xd4e0cb08 ---
_mtx_lock_sleep(c2b75644,c2b9e800,0,c0766f04,16d2,...) at _mtx_lock_sleep+0x92
_mtx_lock_flags(c2b75644,0,c0766f04,16d2,c2b75644,...) at _mtx_lock_flags+0x41
ath_ioctl(c2aa0000,801c69ea,c2cae2c0,0,0,...) at ath_ioctl+0x49
in_control(c2c3d18c,801c69ea,c2cae2c0,c2aa0000,c2b9e800,...) at in_control+0xdec
ifioctl(c2c3d18c,801c69ea,c2cae2c0,c2b9e800,801c69ea,...) at ifioctl+0x4bd
soo_ioctl(c2bbbe10,801c69ea,c2cae2c0,c294ea00,c2b9e800,...) at soo_ioctl+0x5f9
kern_ioctl(c2b9e800,3,801c69ea,c2cae2c0,17,...) at kern_ioctl+0x351
ioctl(c2b9e800,d4e0ccfc,c,c295ec00,d4e0ccb8,...) at ioctl+0x13f
syscall(d4e0cd38) at syscall+0x345
Xint0x80_syscall() at Xint0x80_syscall+0x20
--- syscall (54, FreeBSD ELF32, ioctl), eip = 0x2835c593, esp = 0xbfbfe1ec, ebp 
= 0xbfbfe238 ---
Uptime: 1m3s
Physical memory: 503 MB
Dumping 45 MB: 30 14

#0  doadump () at pcpu.h:195
195     pcpu.h: No such file or directory.
        in pcpu.h
(kgdb) bt
#0  doadump () at pcpu.h:195
#1  0xc04e8333 in boot (howto=260) at /usr/src/sys/kern/kern_shutdown.c:409
#2  0xc04e856a in panic (fmt=Variable "fmt" is not available.
) at /usr/src/sys/kern/kern_shutdown.c:563
#3  0xc0641cb3 in trap_fatal (frame=0xd4e0cab0, eva=3266795092)
    at /usr/src/sys/i386/i386/trap.c:872
#4  0xc0641f1b in trap_pfault (frame=0xd4e0cab0, usermode=0, eva=3266795092)
    at /usr/src/sys/i386/i386/trap.c:785
#5  0xc06428b2 in trap (frame=0xd4e0cab0) at /usr/src/sys/i386/i386/trap.c:463
#6  0xc062fd9b in calltrap () at /usr/src/sys/i386/i386/exception.s:139
#7  0xc04dc302 in _mtx_lock_sleep (m=0xc2b75644, tid=3266963456, opts=0, 
    file=0xc0766f04 "/usr/src/sys/modules/ath/../../dev/ath/if_ath.c", 
    line=5842) at atomic.h:149
#8  0xc04dc691 in _mtx_lock_flags (m=0xc2b75644, opts=0, 
    file=0xc0766f04 "/usr/src/sys/modules/ath/../../dev/ath/if_ath.c", 
    line=5842) at /usr/src/sys/kern/kern_mutex.c:186
#9  0xc07644c9 in ?? ()
#10 0xc2b75644 in ?? ()
#11 0x00000000 in ?? ()
#12 0xc0766f04 in ?? ()
#13 0x000016d2 in ?? ()
#14 0xc2b75644 in ?? ()
#15 0xc2b7422c in ?? ()
#16 0x801c69ea in ?? ()
---Type <return> to continue, or q <return> to quit---
#17 0x00000000 in ?? ()
#18 0xc2aa0000 in ?? ()
#19 0xd4e0cbb0 in ?? ()
#20 0xc059532c in in_control (so=0xc2aa0000, cmd=3266789376, 
    data=0xc2cae2c0 "ath0", ifp=0xc2aa0000, td=0x0)
    at /usr/src/sys/netinet/in.c:481
Previous frame identical to this frame (corrupt stack?)


--
Ian Freislich