Panic in 7.0-BETA1 - USB-related?

Panic happened yesterday when turning on an external, USB connected
hard drive.  Sources from the 7_RELENG branch from Monday, 10/29/07.
The backtrace makes it appear that there is something going on in the
CAM system.  Apologies if this is already a known issue.  See below
for uname and backtrace info.

[mtosto_at_mtosto-bsd ~]$ uname -a
FreeBSD mtosto-bsd.aei-msn.aeieng.com 7.0-BETA1 FreeBSD 7.0-BETA1 #1:
Mon Oct 29 14:14:58 CDT 2007
mtosto_at_mtosto-bsd.aei-msn.aeieng.com:/usr/obj/usr/src/sys/SMP-CUSTOM
i386

mtosto-bsd# kgdb kernel.debug /var/crash/vmcore.0
[GDB will not be able to debug user-mode threads:
/usr/lib/libthread_db.so: Undefined symbol "ps_pglobal_lookup"]
GNU gdb 6.1.1 [FreeBSD]
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i386-marcel-freebsd".

Unread portion of the kernel message buffer:
umass1: BBB bulk-in clear stall failed, IOERROR
umass1: BBB bulk-out clear stall failed, IOERROR
umass1: BBB reset failed, IOERROR
umass1: BBB bulk-in clear stall failed, IOERROR
umass1: at uhub1 port 3 (addr 6) disconnected


Fatal trap 12: page fault while in kernel mode
cpuid = 1; apic id = 01
fault virtual address   = 0x0
fault code              = supervisor write, page not present
instruction pointer     = 0x20:0xc044c4db
stack pointer           = 0x28:0xe5b279b4
frame pointer           = 0x28:0xe5b279d0
code segment            = base 0x0, limit 0xfffff, type 0x1b
                        = DPL 0, pres 1, def32 1, gran 1
processor eflags        = interrupt enabled, resume, IOPL = 0
current process         = 29 (usb1)
trap number             = 12
panic: page fault
cpuid = 1
Uptime: 5d3h6m59s
Physical memory: 2030 MB
Dumping 316 MB: 301 285 269 253 237 221 205 189 173 157 141 125 109 93
77 61 45 29 13

#0  doadump () at pcpu.h:195
195             __asm __volatile("movl %%fs:0,%0" : "=r" (td));
(kgdb) bt
#0  doadump () at pcpu.h:195
#1  0xc05cfaf7 in boot (howto=260) at /usr/src/sys/kern/kern_shutdown.c:409
#2  0xc05cfdb9 in panic (fmt=Variable "fmt" is not available.
) at /usr/src/sys/kern/kern_shutdown.c:563
#3  0xc0826a9c in trap_fatal (frame=0xe5b27974, eva=0)
    at /usr/src/sys/i386/i386/trap.c:872
#4  0xc0826d20 in trap_pfault (frame=0xe5b27974, usermode=0, eva=0)
    at /usr/src/sys/i386/i386/trap.c:785
#5  0xc0827695 in trap (frame=0xe5b27974) at /usr/src/sys/i386/i386/trap.c:463
#6  0xc080d6ab in calltrap () at /usr/src/sys/i386/i386/exception.s:139
#7  0xc044c4db in xpt_done (done_ccb=0xc7514400) at
/usr/src/sys/cam/cam_xpt.c:4856
#8  0xc045278e in probedone (periph=0xcc941600, done_ccb=Variable
"done_ccb" is not available.
)
    at /usr/src/sys/cam/cam_xpt.c:6331
#9  0xc044e521 in camisr_runqueue (V_queue=Variable "V_queue" is not available.
) at /usr/src/sys/cam/cam_xpt.c:7255
#10 0xc0452d9f in xpt_bus_deregister (pathid=2) at
/usr/src/sys/cam/cam_xpt.c:4442
#11 0xc0552320 in umass_cam_detach_sim (sc=0xc6b42400)
    at /usr/src/sys/dev/usb/umass.c:2694
#12 0xc05523cd in umass_detach (self=0xcc8a1200) at
/usr/src/sys/dev/usb/umass.c:1542
#13 0xc05f28c8 in device_detach (dev=0xcc8a1200) at device_if.h:212
#14 0xc0557cf2 in usb_disconnect_port (up=0xc5636c58, parent=0xc5635700)
    at /usr/src/sys/dev/usb/usb_subr.c:1380
#15 0xc054f88e in uhub_explore (dev=0xc5635580) at
/usr/src/sys/dev/usb/uhub.c:462
#16 0xc0555ea5 in usb_discover (v=Variable "v" is not available.
) at /usr/src/sys/dev/usb/usb.c:724
#17 0xc0556e97 in usb_event_thread (arg=0xc563e140) at
/usr/src/sys/dev/usb/usb.c:440
#18 0xc05b00d9 in fork_exit (callout=0xc0556de0 <usb_event_thread>,
arg=0xc563e140,
    frame=0xe5b27d38) at /usr/src/sys/kern/kern_fork.c:796
#19 0xc080d720 in fork_trampoline () at /usr/src/sys/i386/i386/exception.s:205
(kgdb) list *0xc044c4db
0xc044c4db is in xpt_done (/usr/src/sys/cam/cam_xpt.c:4856).
4851                     * any of the "non-immediate" type of ccbs.
4852                     */
4853                    sim = done_ccb->ccb_h.path->bus->sim;
4854                    switch (done_ccb->ccb_h.path->periph->type) {
4855                    case CAM_PERIPH_BIO:
4856                            TAILQ_INSERT_TAIL(&sim->sim_doneq,
&done_ccb->ccb_h,
4857                                              sim_links.tqe);
4858                            done_ccb->ccb_h.pinfo.index = CAM_DONEQ_INDEX;
4859                            if ((sim->flags & CAM_SIM_ON_DONEQ) == 0) {
4860                                    mtx_lock(&cam_simq_lock);
(kgdb)