Strange panic on fresh RELENG_7

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi,

I got frequent kernel panics under moderate load with exactly same fatal
virtual address and backtrace after updating to fresh RELENG_7:

Fatal trap 12: page fault while in kernel mode
cpuid = 2; apic id = 02
fault virtual address   = 0x8100320
fault code              = supervisor read, page not present
instruction pointer     = 0x20:0xc073d819
stack pointer           = 0x28:0xe66bba9c
frame pointer           = 0x28:0xe66bbaf4
code segment            = base 0x0, limit 0xfffff, type 0x1b
                        = DPL 0, pres 1, def32 1, gran 1
processor eflags        = interrupt enabled, resume, IOPL = 0
current process         = 2898 (cc1)
trap number             = 12
panic: page fault
cpuid = 2
Uptime: 1h15m45s
Physical memory: 1015 MB
Dumping 193 MB: 178 162 146 130 114 98 82 66 50 34 18 2

Any hints?

(kgdb) bt
#0  doadump () at pcpu.h:195
#1  0xc05651a7 in boot (howto=260) at /usr/src/sys/kern/kern_shutdown.c:409
#2  0xc0565469 in panic (fmt=Variable "fmt" is not available.
) at /usr/src/sys/kern/kern_shutdown.c:563
#3  0xc077678c in trap_fatal (frame=0xe66bba5c, eva=135267104) at
/usr/src/sys/i386/i386/trap.c:872
#4  0xc07769f0 in trap_pfault (frame=0xe66bba5c, usermode=0,
eva=135267104) at /usr/src/sys/i386/i386/trap.c:785
#5  0xc0777312 in trap (frame=0xe66bba5c) at
/usr/src/sys/i386/i386/trap.c:463
#6  0xc075dd6b in calltrap () at /usr/src/sys/i386/i386/exception.s:139
#7  0xc073d819 in vm_page_splay (pindex=Unhandled dwarf expression
opcode 0x93
) at /usr/src/sys/vm/vm_page.c:590
#8  0xc073dd8d in vm_page_remove (m=0xc1c127b0) at
/usr/src/sys/vm/vm_page.c:718
#9  0xc073dfd1 in vm_page_free_toq (m=0xc1c127b0) at
/usr/src/sys/vm/vm_page.c:1290
#10 0xc073e1a6 in vm_page_free (m=0xc1c127b0) at
/usr/src/sys/vm/vm_page.c:498
#11 0xc073c795 in vm_object_terminate (object=0xc6dae9b0) at
/usr/src/sys/vm/vm_object.c:647
#12 0xc073d003 in vm_object_deallocate (object=0xc6dae9b0) at
/usr/src/sys/vm/vm_object.c:580
#13 0xc0735858 in vm_map_delete (map=Variable "map" is not available.
) at /usr/src/sys/vm/vm_map.c:2306
#14 0xc07358e1 in vm_map_remove (map=0xc3afe3a0, start=0,
end=3217031168) at /usr/src/sys/vm/vm_map.c:2414
#15 0xc0737aaf in vmspace_exit (td=0xc40a7880) at
/usr/src/sys/vm/vm_map.c:321
#16 0xc0544583 in exit1 (td=0xc40a7880, rv=0) at
/usr/src/sys/kern/kern_exit.c:294
#17 0xc05458dd in sys_exit (td=Could not find the frame base for "sys_exit".
) at /usr/src/sys/kern/kern_exit.c:98
#18 0xc0776d29 in syscall (frame=0xe66bbd38) at
/usr/src/sys/i386/i386/trap.c:1008
#19 0xc075ddd0 in Xint0x80_syscall () at
/usr/src/sys/i386/i386/exception.s:196
#20 0x00000033 in ?? ()
Previous frame inner to this frame (corrupt stack?)
(kgdb) bt full
#0  doadump () at pcpu.h:195
No locals.
#1  0xc05651a7 in boot (howto=260) at /usr/src/sys/kern/kern_shutdown.c:409
        _giantcnt = Variable "_giantcnt" is not available.
(kgdb) up 7
#7  0xc073d819 in vm_page_splay (pindex=Unhandled dwarf expression
opcode 0x93
) at /usr/src/sys/vm/vm_page.c:590
590                             if ((y = root->right) == NULL)
(kgdb) inspect root
$1 = 0xc1e931b0
(kgdb) inspect root->right
$2 = (struct vm_page *) 0x8100300
(kgdb) inspect y
$3 = 0x8100300
(kgdb) inspect *root
$4 = {pageq = {tqe_next = 0x0, tqe_prev = 0x32123000}, listq = {tqe_next
= 0x0, tqe_prev = 0x0}, left = 0xc1e931bc, right = 0x8100300, object =
0x1000b, pindex = 0,
  phys_addr = 16711680, md = {pv_list_count = -1041980184, pv_list =
{tqh_first = 0xc1c72990, tqh_last = 0xc1e4a4e8}}, queue = 152 '\230',
segind = 41 ')', flags = 49607,
  order = 144 '\220', pool = 41 ')', wire_count = 49607, cow = 0,
hold_count = -23460, oflags = 50980, act_count = 1 '\001', busy = 0
'\0', valid = 0 '\0', dirty = 0 '\0'}
(kgdb)


- --
Xin LI <delphij_at_delphij.net>	http://www.delphij.net/
FreeBSD - The Power to Serve!
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (FreeBSD)

iD8DBQFHO/bghcUczkLqiksRApKQAKDRGFbGrMXEm8oh6RJnjpz+QcPKJACdFRj6
5ID1FBA+HsgtrjD9/BxeiTE=
=RIdX
-----END PGP SIGNATURE-----