swap_pager_swap_init panic

I've got an SMP netbooting test machine, which panics on startup almost
100% of the time with the issue that has been reported since 2006-12-02
at least:
db> where
Tracing pid 40 tid 100040 td 0xffffff003b9e24c0
kdb_enter() at kdb_enter+0x2f
panic() at panic+0x291
swap_pager_swap_init() at swap_pager_swap_init+0x20c
vm_pageout() at vm_pageout+0x17c
fork_exit() at fork_exit+0x86
fork_trampoline() at fork_trampoline+0xe

It's just after this chunk of the normal dmesg:
May  4 16:52:03 explosivo kernel: acd0: DVDR <PLEXTOR DVDR PX-716A/1.09> at ata5-master SATA150
May  4 16:52:03 explosivo kernel: Sending DHCP Discover packet from interface em0 (00:16:76:ae:66:f1)
May  4 16:52:03 explosivo kernel: Sending DHCP Discover packet from interface fwe0 (02:90:27:b0:f0:d9)
May  4 16:52:03 explosivo kernel: Received DHCP Offer packet on em0 from 192.168.0.103 (accepted) (no root path)
May  4 16:52:03 explosivo kernel: Received DHCP Offer packet on em0 from 192.168.0.103 (ignored) (no root path)
May  4 16:52:03 explosivo kernel: Sending DHCP Request packet from interface em0 (00:16:76:ae:66:f1)
May  4 16:52:03 explosivo kernel: Received DHCP Ack packet on em0 from 192.168.0.103 (accepted) (got root path)
May  4 16:52:03 explosivo kernel: DHCP timeout for interface fwe0
May  4 16:52:03 explosivo kernel: em0 at 192.168.0.4 server 192.168.0.103 boot file /usr/src/nbcurrent/boot/pxeboot
May  4 16:52:03 explosivo kernel: subnet mask 255.255.255.0 router 192.168.0.1 rootfs 192.168.0.103:/usr/src/nbcurrent 
May  4 16:52:03 explosivo kernel: Adjusted interface em0
May  4 16:52:03 explosivo kernel: Shutdown interface fwe0
May  4 16:52:03 explosivo kernel: SMP: AP CPU #1 Launched!

That swap_pager_swap_init() panic is about a NULL getting returned, and
I tracked it down to the "if ((zone != slabzone) && (zone !=
slabrefzone))" NULL return, where I've put a panic in.
kdb_enter()
panic()
uma_zone_slab()
uma_zalloc_internal()
uma_zcreate()
swap_pager_swap_init()
vm_pageout()
fork_exit()
fork_trampoline()

That's pagedaemon, and the other running process is swapper:
cpustop_handler()
ipi_nmi_hanlder()
trap()
calltrap()
siocnopen()
sio_cnputc()
cnputc()
putcons()
putchar()
kvprintf()
printf()
uma_zone_slab()
uma_zalloc_bucket()
uma_zalloc_arg()
vm_map_entry_create
vm_map_insert()
kmem_malloc()
page_alloc()
startup_alloc()
slab_alloc()
uma_zone_slab()
uma_zalloc_internal()
uma_zcreate()
vfs_mountroot()
start_init()
fork_exit()
fork_trampoline()

That printf should be mine, from some debugging I was sprinkling around.

See also PR amd64/106186 which notes that turning off SMP fixes it
(certainly does for me).  I haven't tested the turning-off-firewire
which was suggested, since I can't do it just from loader.conf
apparently.

Any ideas on fixing it?

-- 
Eric Anholt                             anholt_at_FreeBSD.org
eric_at_anholt.net                         eric.anholt_at_intel.com