panic: Lock so_rcv_sx not exclusively locked

Recent -current kernels can reliably be made to panic by killing npviewer.bin.
Right before killing, npviewer.bin shows up like this in top:

 6288 jos           1  45    5 62844K 36788K so_rcv   0:08  0.00% npviewer.bin

lizzy:~/crash% kgdb /usr/obj/usr/src/sys/LIZZY/kernel.debug vmcore.1 
kgdb: kvm_nlist(_stopped_cpus): 
kgdb: kvm_nlist(_stoppcbs): 
[GDB will not be able to debug user-mode threads: /usr/lib/libthread_db.so: Undefined symbol "ps_pglobal_lookup"]
GNU gdb 6.1.1 [FreeBSD]
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i386-marcel-freebsd".

Unread portion of the kernel message buffer:
panic: Lock so_rcv_sx not exclusively locked _at_ /usr/src/sys/kern/uipc_sockbuf.c:157

Uptime: 5h23m39s
Physical memory: 1527 MB
Dumping 247 MB: 232 216 200 184 168 152 136 120 104 88 72 56 40 24 8

#0  doadump () at pcpu.h:195
195     pcpu.h: No such file or directory.
        in pcpu.h
(kgdb) bt
#0  doadump () at pcpu.h:195
#1  0xc05435ef in boot (howto=260) at /usr/src/sys/kern/kern_shutdown.c:417
#2  0xc0543867 in panic (fmt=Variable "fmt" is not available.
) at /usr/src/sys/kern/kern_shutdown.c:571
#3  0xc054a427 in _sx_assert (sx=0xc4fb89a0, what=4, 
    file=0xc06d49ca "/usr/src/sys/kern/uipc_sockbuf.c", line=157)
    at /usr/src/sys/kern/kern_sx.c:931
#4  0xc054a8da in _sx_xunlock (sx=0xc4fb89a0, 
    file=0xc06d49ca "/usr/src/sys/kern/uipc_sockbuf.c", line=157)
    at /usr/src/sys/kern/kern_sx.c:316
#5  0xc0595444 in sbunlock (sb=0xc4fb8968)
    at /usr/src/sys/kern/uipc_sockbuf.c:157
#6  0xc0598245 in sorflush (so=0xc4fb8918)
    at /usr/src/sys/kern/uipc_socket.c:1902
#7  0xc05982df in soshutdown (so=0xc4fb8918, how=2)
    at /usr/src/sys/kern/uipc_socket.c:1866
#8  0xc059ce86 in shutdown (td=0xc4b31880, uap=0xe7219c58)
    at /usr/src/sys/kern/uipc_syscalls.c:1248
#9  0xc07ffa80 in ?? ()
#10 0xc4b31880 in ?? ()
#11 0xe7219c58 in ?? ()
#12 0x00000008 in ?? ()
#13 0x00000000 in ?? ()
#14 0x00000000 in ?? ()
#15 0xc103d800 in ?? ()
#16 0x00000c1e in ?? ()
#17 0x00000000 in ?? ()
#18 0xc4e25488 in ?? ()
#19 0xc5007e9c in ?? ()
#20 0x00000000 in ?? ()
#21 0x00000000 in ?? ()
#22 0xe7219c72 in ?? ()
#23 0x00000004 in ?? ()
#24 0x80000000 in ?? ()
#25 0xe7219c8c in ?? ()
---Type <return> to continue, or q <return> to quit--- 
#26 0xc06a1a44 in __qdivrem (uq=Unhandled dwarf expression opcode 0x93
) at /usr/src/sys/libkern/qdivrem.c:186
#27 0xc0697b93 in syscall (frame=0xe7219d38)
    at /usr/src/sys/i386/i386/trap.c:1034
#28 0xc06818b0 in Xint0x80_syscall () at /usr/src/sys/i386/i386/exception.s:203
#29 0x00000033 in ?? ()
Previous frame inner to this frame (corrupt stack?)
(kgdb) 


-- 
Jos Backus
jos at catnook.com