ZFS Panic: Memory Modified After Free

Hi Folks,
    I got a "memory modified after free" panic with zfs whilst dumping 
1000's of debug messages/sec to syslog (long story)

Sadly I've no serial console so ddb info is via photos:

http://wcl.ml.unisa.edu.au/~closebs/FreeBSD

Photo order:
    o Panic msg & backtrace (445)
    o lockedvnods with trace (446)
    o ps (460)
    o uma (448)
    o proc (449)
    o witness (450)
    o all pcpu (480)

box:

FreeBSD wolf.clearchain.com 7.0-CURRENT FreeBSD 7.0-CURRENT #0: Thu Oct 
11 08:12:46 CST 2007

benjsc_at_wolf:~| ident /boot/kernel/zfs.ko
/boot/kernel/zfs.ko:
     $FreeBSD: src/sys/compat/opensolaris/kern/opensolaris_kmem.c,v 1.2 
2007/04/10 02:35:56 pjd Exp $
     $FreeBSD: src/sys/compat/opensolaris/kern/opensolaris_kobj.c,v 1.4 
2007/05/31 11:51:49 kib Exp $
     $FreeBSD: src/sys/compat/opensolaris/kern/opensolaris_kstat.c,v 1.2 
2007/06/04 18:25:03 dwmalone Exp $
     $FreeBSD: src/sys/compat/opensolaris/kern/opensolaris_misc.c,v 1.2 
2007/04/23 00:52:06 pjd Exp $
     $FreeBSD: src/sys/compat/opensolaris/kern/opensolaris_policy.c,v 
1.2 2007/06/12 00:11:57 rwatson Exp $
     $FreeBSD: src/sys/compat/opensolaris/kern/opensolaris_vfs.c,v 1.6 
2007/06/04 11:31:45 pjd Exp $
     $FreeBSD: src/sys/compat/opensolaris/kern/opensolaris_zone.c,v 1.1 
2007/04/06 01:09:06 pjd Exp $

(gdb) l *zfs_kmem_alloc+0x12
0x3f62 is in zfs_kmem_alloc 
(/devel/src/sys/modules/zfs/../../compat/opensolaris/kern/opensolaris_kmem.c:90).
85      
/devel/src/sys/modules/zfs/../../compat/opensolaris/kern/opensolaris_kmem.c: 
No such file or directory.
        in 
/devel/src/sys/modules/zfs/../../compat/opensolaris/kern/opensolaris_kmem.c

(gdb) l *dmu_buf_hold_array_by_dnode+0x91
0x1aa51 is in dmu_buf_hold_array_by_dnode 
(/devel/src/sys/modules/zfs/../../contrib/opensolaris/uts/common/fs/zfs/dmu.c:193).
188     
/devel/src/sys/modules/zfs/../../contrib/opensolaris/uts/common/fs/zfs/dmu.c: 
No such file or directory.
        in 
/devel/src/sys/modules/zfs/../../contrib/opensolaris/uts/common/fs/zfs/dmu.c

I *think* I've been able to reproduce this just not provide any info ddb 
due to sc being hosed, so can't console switch (ie ddb commands wor just 
no visuals) and panic proved useless.

Cheers,
    Benjamin