Panic in callout_reset()

Running: FreeBSD 7.0-CURRENT #5: Sat Jun  9 18:29:40 EST 2007
    root_at_server.vk2pj.dyndns.org:/var/obj/k7/usr/src/sys/server
Panic String: Bad tailq NEXT(0xcce421a8->tqh_last) != NULL

#0  doadump () at pcpu.h:195
#1  0xc04524a9 in db_fncall (dummy1=0xc0576aa2, dummy2=0x0, dummy3=0x1, dummy4=0xd3b23a3c "")
    at /usr/src/sys/ddb/db_command.c:486
#2  0xc0452a15 in db_command_loop () at /usr/src/sys/ddb/db_command.c:401
#3  0xc0454195 in db_trap (type=0x3, code=0x0) at /usr/src/sys/ddb/db_main.c:222
#4  0xc0576943 in kdb_trap (type=0x3, code=0x0, tf=0xd3b23bd4) at /usr/src/sys/kern/subr_kdb.c:502
#5  0xc06d4d4b in trap (frame=0xd3b23bd4) at /usr/src/sys/i386/i386/trap.c:620
#6  0xc06c21db in calltrap () at /usr/src/sys/i386/i386/exception.s:139
#7  0xc0576aa2 in kdb_enter (msg=0xc0719d31 "panic") at cpufunc.h:60
#8  0xc0550035 in panic (fmt=0xc06fdb26 "Bad tailq NEXT(%p->tqh_last) != NULL")
    at /usr/src/sys/kern/kern_shutdown.c:547
#9  0xc056180a in callout_reset (c=0xc07ec000, to_ticks=0xa, ftn=0xc063fd30 <nfsrv_timer>, arg=0x0)
    at /usr/src/sys/kern/kern_timeout.c:477
#10 0xc063fde4 in nfsrv_timer (arg=0x0) at /usr/src/sys/nfsserver/nfs_srvsock.c:815
#11 0xc0561f1e in softclock (dummy=0x0) at /usr/src/sys/kern/kern_timeout.c:280
#12 0xc0534485 in ithread_loop (arg=0xc2926670) at /usr/src/sys/kern/kern_intr.c:1036
#13 0xc0531a57 in fork_exit (callout=0xc05342d0 <ithread_loop>, arg=0xc2926670, frame=0xd3b23d38)
    at /usr/src/sys/kern/kern_fork.c:787
#14 0xc06c2250 in fork_trampoline () at /usr/src/sys/i386/i386/exception.s:205

'c' in callout_reset looks like:
(kgdb) p *c
$1 = {
  c_links = {
    sle = {
      sle_next = 0xc07e5e08
    }, 
    tqe = {
      tqe_next = 0xc07e5e08, 
      tqe_prev = 0xcce42158
    }
  }, 
  c_time = 0x3230ae73, 
  c_arg = 0x0, 
  c_func = 0xc063fd30 <nfsrv_timer>, 
  c_mtx = 0x0, 
  c_flags = 0x16
}

(kgdb) p *$1.c_links.tqe.tqe_next
$3 = {
  c_links = {
    sle = {
      sle_next = 0x0
    }, 
    tqe = {
      tqe_next = 0x0, 
      tqe_prev = 0xcce42158
    }
  }, 
  c_time = 0x3230ae69, 
  c_arg = 0x0, 
  c_func = 0xc0605f80 <tcp_isn_tick>, 
  c_mtx = 0x0, 
  c_flags = 0x16
}
(kgdb) p *$1.c_links.tqe.tqe_prev
$5 = (struct callout *) 0xc07e5e08

Any suggestions?

-- 
Peter Jeremy