panic mounting ntfs

In doing some data recovery for my brother-in-law, I tried to mount
his win2k partition (NTFS), and the box immediately panic'd. I dd'd
the partition and was able to mount it on my 7.0-RELEASE box (via
mdconfig -t vnode ...), but trying to do that on the -CURRENT box also
panic'd.

System info:

FreeBSD dev.pflog.net 8.0-CURRENT FreeBSD 8.0-CURRENT #1: Tue May  6
18:09:21 EDT 2008     root_at_:/usr/obj/usr/src/sys/DEV  i386

dmesg below (after the panic output).

The NTFS filesystem in question may be "dirty", so that may be part of
the problem. However, it mounts ok on 7.0-RELEASE and I would expect
it to report a warning/error if the fs wasn't clean.

The panic was:

panic: Assertion (flags & ~LK_INIT_MASK) == 0 failed at
/usr/src/sys/kern/kern_lock.c:298

And here's the backtrace:

#0  doadump () at pcpu.h:196
#1  0xc05c200e in boot (howto=260) at /usr/src/sys/kern/kern_shutdown.c:418
#2  0xc05c22d3 in panic (fmt=Variable "fmt" is not available.
) at /usr/src/sys/kern/kern_shutdown.c:572
#3  0xc04adab7 in db_panic (addr=Could not find the frame base for "db_panic".
) at /usr/src/sys/ddb/db_command.c:446
#4  0xc04ae4bc in db_command (last_cmdp=0xc083e5b4, cmd_table=0x0,
dopager=1) at /usr/src/sys/ddb/db_command.c:413
#5  0xc04ae5ca in db_command_loop () at /usr/src/sys/ddb/db_command.c:466
#6  0xc04afdbd in db_trap (type=3, code=0) at /usr/src/sys/ddb/db_main.c:228
#7  0xc05ec646 in kdb_trap (type=3, code=0, tf=0xe79a4700) at
/usr/src/sys/kern/subr_kdb.c:510
#8  0xc078571f in trap (frame=0xe79a4700) at /usr/src/sys/i386/i386/trap.c:643
#9  0xc076a33b in calltrap () at /usr/src/sys/i386/i386/exception.s:146
#10 0xc05ec7ca in kdb_enter (why=0xc07d33ae "panic", msg=0xc07d33ae
"panic") at cpufunc.h:60
#11 0xc05c22bc in panic (fmt=0xc07bcbce "Assertion %s failed at
%s:%d") at /usr/src/sys/kern/kern_shutdown.c:556
#12 0xc05ad5a9 in lockinit (lk=0xc50ed524, pri=72, wmesg=0xc54a7670
"ntnode", timo=0, flags=-1056735775) at
/usr/src/sys/kern/kern_lock.c:298
#13 0xc54a6b00 in ntfs_ntlookup (ntmp=0xc5467800, ino=0,
ipp=0xe79a47f4) at
/usr/src/sys/modules/ntfs/../../fs/ntfs/ntfs_subr.c:408
#14 0xc54a1871 in ntfs_vgetex (mp=0xc4e8c28c, ino=0, attrtype=128,
attrname=0x0, lkflags=524288, flags=0, td=0xc4f61660, vpp=0xc5467859)
    at /usr/src/sys/modules/ntfs/../../fs/ntfs/ntfs_vfsops.c:665
#15 0xc54a2069 in ntfs_vget (mp=0xc4e8c28c, ino=0, lkflags=524288,
vpp=0xc5467859) at
/usr/src/sys/modules/ntfs/../../fs/ntfs/ntfs_vfsops.c:765
#16 0xc54a1364 in ntfs_mount (mp=0xc4e8c28c, td=0xc4f61660) at
/usr/src/sys/modules/ntfs/../../fs/ntfs/ntfs_vfsops.c:371
#17 0xc063ceb1 in vfs_donmount (td=0xc4f61660, fsflags=1,
fsoptions=0xe79a4b90) at /usr/src/sys/kern/vfs_mount.c:1014
#18 0xc063d4c8 in kernel_mount (ma=0xc4cccb90, flags=1) at
/usr/src/sys/kern/vfs_mount.c:2295
#19 0xc54a0a60 in ntfs_cmount (ma=Variable "ma" is not available.
) at /usr/src/sys/modules/ntfs/../../fs/ntfs/ntfs_vfsops.c:141
#20 0xc063b471 in mount (td=0xc4f61660, uap=0xe79a4cfc) at
/usr/src/sys/kern/vfs_mount.c:820
#21 0xc0784ed3 in syscall (frame=0xe79a4d38) at
/usr/src/sys/i386/i386/trap.c:1026
#22 0xc076a3a0 in Xint0x80_syscall () at /usr/src/sys/i386/i386/exception.s:203
#23 0x00000033 in ?? ()
Previous frame inner to this frame (corrupt stack?)

dmesg output:

Copyright (c) 1979, 1980, 1983, 1986, 1988, 1989, 1991, 1992, 1993, 1994
	The Regents of the University of California. All rights reserved.
FreeBSD is a registered trademark of The FreeBSD Foundation.
FreeBSD 8.0-CURRENT #1: Tue May  6 18:09:21 EDT 2008
    root_at_:/usr/obj/usr/src/sys/DEV
WARNING: WITNESS option enabled, expect reduced performance.
module_register: module cpu/coretemp already exists!
Module cpu/coretemp failed to register: 17
Timecounter "i8254" frequency 1193182 Hz quality 0
CPU: Intel(R) Core(TM)2 CPU         X6900  _at_ 3.20GHz (3202.57-MHz 686-class CPU)
  Origin = "GenuineIntel"  Id = 0x6f6  Stepping = 6
  Features=0xbfebfbff<FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CLFLUSH,DTS,ACPI,MMX,FXSR,SSE,SSE2,SS,HTT,TM,PBE>
  Features2=0xe3bd<SSE3,RSVD2,MON,DS_CPL,VMX,EST,TM2,SSSE3,CX16,xTPR,PDCM>
  AMD Features=0x20100000<NX,LM>
  AMD Features2=0x1<LAHF>
  Cores per package: 2
real memory  = 2147024896 (2047 MB)
avail memory = 2097856512 (2000 MB)
ACPI APIC Table: <MSTEST OEMAPIC >
FreeBSD/SMP: Multiprocessor System Detected: 2 CPUs
 cpu0 (BSP): APIC ID:  0
 cpu1 (AP): APIC ID:  1
ioapic0 <Version 2.0> irqs 0-23 on motherboard
netsmb_dev: loaded
acpi0: <MSTEST TESTONLY> on motherboard
acpi0: [ITHREAD]
acpi0: Power Button (fixed)
acpi0: reservation of 0, a0000 (3) failed
acpi0: reservation of 100000, 7ff00000 (3) failed
Timecounter "ACPI-fast" frequency 3579545 Hz quality 1000
acpi_timer0: <24-bit timer at 3.579545MHz> port 0x808-0x80b on acpi0
pcib0: <ACPI Host-PCI bridge> port 0xcf8-0xcff on acpi0
pci0: <ACPI PCI bus> on pcib0
pcib1: <ACPI PCI-PCI bridge> irq 16 at device 1.0 on pci0
pci1: <ACPI PCI bus> on pcib1
vgapci0: <VGA-compatible display> mem
0xfd000000-0xfdffffff,0xc0000000-0xcfffffff,0xfc000000-0xfcffffff irq
16 at device 0.0 on pci1
uhci0: <Intel 82801H (ICH8) USB controller USB-D> port 0xdc00-0xdc1f
irq 16 at device 26.0 on pci0
uhci0: [GIANT-LOCKED]
uhci0: [ITHREAD]
usb0: <Intel 82801H (ICH8) USB controller USB-D> on uhci0
usb0: USB revision 1.0
uhub0: <Intel UHCI root hub, class 9/0, rev 1.00/1.00, addr 1> on usb0
uhub0: 2 ports with 2 removable, self powered
uhci1: <Intel 82801H (ICH8) USB controller USB-E> port 0xe000-0xe01f
irq 17 at device 26.1 on pci0
uhci1: [GIANT-LOCKED]
uhci1: [ITHREAD]
usb1: <Intel 82801H (ICH8) USB controller USB-E> on uhci1
usb1: USB revision 1.0
uhub1: <Intel UHCI root hub, class 9/0, rev 1.00/1.00, addr 1> on usb1
uhub1: 2 ports with 2 removable, self powered
ehci0: <Intel 82801H (ICH8) USB 2.0 controller USB2-B> mem
0xfebffc00-0xfebfffff irq 18 at device 26.7 on pci0
ehci0: [GIANT-LOCKED]
ehci0: [ITHREAD]
usb2: waiting for BIOS to give up control
usb2: EHCI version 1.0
usb2: companion controllers, 2 ports each: usb0 usb1
usb2: <Intel 82801H (ICH8) USB 2.0 controller USB2-B> on ehci0
usb2: USB revision 2.0
uhub2: <Intel EHCI root hub, class 9/0, rev 2.00/1.00, addr 1> on usb2
uhub2: 4 ports with 4 removable, self powered
pcib2: <ACPI PCI-PCI bridge> irq 16 at device 28.0 on pci0
pci4: <ACPI PCI bus> on pcib2
pcib3: <ACPI PCI-PCI bridge> irq 19 at device 28.3 on pci0
pci3: <ACPI PCI bus> on pcib3
re0: <RealTek 8168/8111B PCIe Gigabit Ethernet> port 0xc800-0xc8ff mem
0xfeaff000-0xfeafffff irq 19 at device 0.0 on pci3
miibus0: <MII bus> on re0
rgephy0: <RTL8169S/8110S/8211B media interface> PHY 1 on miibus0
rgephy0:  10baseT, 10baseT-FDX, 100baseTX, 100baseTX-FDX, 1000baseT,
1000baseT-FDX, auto
re0: Ethernet address: 00:17:31:f2:32:59
re0: [FILTER]
pcib4: <ACPI PCI-PCI bridge> irq 16 at device 28.4 on pci0
pci2: <ACPI PCI bus> on pcib4
atapci0: <JMicron JMB363 SATA300 controller> port
0xbc00-0xbc07,0xb880-0xb883,0xb800-0xb807,0xb480-0xb483,0xb400-0xb40f
mem 0xfe9fe000-0xfe9fffff irq 16 at device 0.0 on pci2
atapci0: [ITHREAD]
atapci0: AHCI called from vendor specific driver
atapci0: AHCI Version 01.00 controller with 2 ports PM supported
ata2: <ATA channel 0> on atapci0
ata2: [ITHREAD]
ata3: <ATA channel 1> on atapci0
ata3: [ITHREAD]
ata4: <ATA channel 2> on atapci0
ata4: [ITHREAD]
uhci2: <Intel 82801H (ICH8) USB controller USB-A> port 0xd480-0xd49f
irq 23 at device 29.0 on pci0
uhci2: [GIANT-LOCKED]
uhci2: [ITHREAD]
usb3: <Intel 82801H (ICH8) USB controller USB-A> on uhci2
usb3: USB revision 1.0
uhub3: <Intel UHCI root hub, class 9/0, rev 1.00/1.00, addr 1> on usb3
uhub3: 2 ports with 2 removable, self powered
uhci3: <Intel 82801H (ICH8) USB controller USB-B> port 0xd800-0xd81f
irq 19 at device 29.1 on pci0
uhci3: [GIANT-LOCKED]
uhci3: [ITHREAD]
usb4: <Intel 82801H (ICH8) USB controller USB-B> on uhci3
usb4: USB revision 1.0
uhub4: <Intel UHCI root hub, class 9/0, rev 1.00/1.00, addr 1> on usb4
uhub4: 2 ports with 2 removable, self powered
uhci4: <Intel 82801H (ICH8) USB controller USB-C> port 0xd880-0xd89f
irq 18 at device 29.2 on pci0
uhci4: [GIANT-LOCKED]
uhci4: [ITHREAD]
usb5: <Intel 82801H (ICH8) USB controller USB-C> on uhci4
usb5: USB revision 1.0
uhub5: <Intel UHCI root hub, class 9/0, rev 1.00/1.00, addr 1> on usb5
uhub5: 2 ports with 2 removable, self powered
ehci1: <Intel 82801H (ICH8) USB 2.0 controller USB2-A> mem
0xfebff800-0xfebffbff irq 23 at device 29.7 on pci0
ehci1: [GIANT-LOCKED]
ehci1: [ITHREAD]
usb6: EHCI version 1.0
usb6: companion controllers, 2 ports each: usb3 usb4 usb5
usb6: <Intel 82801H (ICH8) USB 2.0 controller USB2-A> on ehci1
usb6: USB revision 2.0
uhub6: <Intel EHCI root hub, class 9/0, rev 2.00/1.00, addr 1> on usb6
uhub6: 6 ports with 6 removable, self powered
pcib5: <ACPI PCI-PCI bridge> at device 30.0 on pci0
pci5: <ACPI PCI bus> on pcib5
isab0: <PCI-ISA bridge> at device 31.0 on pci0
isa0: <ISA bus> on isab0
pci0: <serial bus, SMBus> at device 31.3 (no driver attached)
atapci1: <Intel ICH8 SATA300 controller> port
0xec00-0xec07,0xe880-0xe883,0xe800-0xe807,0xe480-0xe483,0xe400-0xe40f,0xe080-0xe08f
irq 19 at device 31.5 on pci0
atapci1: [ITHREAD]
ata5: <ATA channel 0> on atapci1
ata5: [ITHREAD]
ata6: <ATA channel 1> on atapci1
ata6: [ITHREAD]
acpi_hpet0: <High Precision Event Timer> iomem 0xfed00000-0xfed003ff on acpi0
Timecounter "HPET" frequency 14318180 Hz quality 900
cpu0: <ACPI CPU> on acpi0
coretemp0: <CPU On-Die Thermal Sensors> on cpu0
cpu1: <ACPI CPU> on acpi0
coretemp1: <CPU On-Die Thermal Sensors> on cpu1
acpi_button0: <Power Button> on acpi0
atrtc0: <AT realtime clock> port 0x70-0x71 irq 8 on acpi0
atkbdc0: <Keyboard controller (i8042)> port 0x60,0x64 irq 1 on acpi0
atkbd0: <AT Keyboard> irq 1 on atkbdc0
kbd0 at atkbd0
atkbd0: [GIANT-LOCKED]
atkbd0: [ITHREAD]
ata0 at port 0x1f0-0x1f7,0x3f6 irq 14 on isa0
ata0: [ITHREAD]
ata1 at port 0x170-0x177,0x376 irq 15 on isa0
ata1: [ITHREAD]
sc0: <System console> at flags 0x100 on isa0
sc0: VGA <16 virtual consoles, flags=0x300>
vga0: <Generic ISA VGA> at port 0x3c0-0x3df iomem 0xa0000-0xbffff on isa0
ums0: <Microsoft Microsoft 5-Button Mouse with IntelliEye(TM), class
0/0, rev 1.10/3.00, addr 2> on uhub3
ums0: 5 buttons and Z dir.
Timecounters tick every 1.000 msec
ad8: 152627MB <WDC WD1600JB-00EVA0 15.05R15> at ata4-master UDMA100
acd0: DVDR <SONY DVD RW DRU-800A/KY06> at ata4-slave UDMA66
SMP: AP CPU #1 Launched!
WARNING: WITNESS option enabled, expect reduced performance.
lock order reversal: (sleepable after non-sleepable)
 1st 0xc4e8d020 struct mount mtx (struct mount mtx) _at_
/usr/src/sys/kern/vfs_subr.c:338
 2nd 0xc4e8d000 vfslock (vfslock) _at_ /usr/src/sys/kern/vfs_subr.c:365
KDB: stack backtrace:
db_trace_self_wrapper(c07d6161,e36f8b6c,c05fe64e,c07d8861,c4e8d000,...)
at db_trace_self_wrapper+0x26
kdb_backtrace(c07d8861,c4e8d000,c07de780,c07de780,c07ded27,...) at
kdb_backtrace+0x29
witness_checkorder(c4e8d000,1,c07ded27,16d,4,...) at witness_checkorder+0x6de
__lockmgr_args(c4e8d000,200100,c4e8d020,0,0,...) at __lockmgr_args+0x220
vfs_busy(c4e8d000,200,0,c4b1ccc0,1,...) at vfs_busy+0x1bc
vfs_mount_alloc(0,c080d9c0,c07deacd,c4b1ccc0,c063b1b0,...) at
vfs_mount_alloc+0x78
vfs_mountroot(c0854dd0,4,c07cdfa9,264,c,...) at vfs_mountroot+0x26c
start_init(0,e36f8d38,c07cf8fb,30d,c4b1acf8,...) at start_init+0x65
fork_exit(c0589e00,0,e36f8d38) at fork_exit+0xb8
fork_trampoline() at fork_trampoline+0x8
--- trap 0, eip = 0, esp = 0xe36f8d70, ebp = 0 ---
lock order reversal: (sleepable after non-sleepable)
 1st 0xc4ce7eb0 vnode interlock (vnode interlock) _at_
/usr/src/sys/fs/devfs/devfs_vnops.c:197
 2nd 0xc4ce7e90 devfs (devfs) _at_ /usr/src/sys/kern/vfs_subr.c:2046
KDB: stack backtrace:
db_trace_self_wrapper(c07d6161,e36f8a98,c05fe64e,c07d8861,c4ce7e90,...)
at db_trace_self_wrapper+0x26
kdb_backtrace(c07d8861,c4ce7e90,c07c894a,c07c894a,c07ded27,...) at
kdb_backtrace+0x29
witness_checkorder(c4ce7e90,9,c07ded27,7fe,c4ce7e90,...) at
witness_checkorder+0x6de
__lockmgr_args(c4ce7e90,80100,c4ce7eb0,0,0,...) at __lockmgr_args+0x777
vop_stdlock(e36f8b90,c07c8b27,c07ccc89,80100,c4ce7e38,...) at vop_stdlock+0x62
VOP_LOCK1_APV(c080da40,e36f8b90,c083b8a0,c4ce7e38,80100,...) at
VOP_LOCK1_APV+0xa5
_vn_lock(c4ce7e38,80100,c07ded27,7fe,c07c8b27,...) at _vn_lock+0x5e
vget(c4ce7e38,80100,c4b1ccc0,c6,c4cd7954,...) at vget+0x9c
devfs_allocv(c4dfc280,c4e8d000,e36f8c20,c4b1ccc0,c4b1cd64,...) at
devfs_allocv+0x11d
devfs_root(c4e8d000,80000,c08a72d8,c4b1ccc0,4,...) at devfs_root+0x51
set_rootvnode(c08a72c0,0,c07de689,5f6,c063b1b0,...) at set_rootvnode+0x2d
vfs_mountroot(c0854dd0,4,c07cdfa9,264,c,...) at vfs_mountroot+0x34c
start_init(0,e36f8d38,c07cf8fb,30d,c4b1acf8,...) at start_init+0x65
fork_exit(c0589e00,0,e36f8d38) at fork_exit+0xb8
fork_trampoline() at fork_trampoline+0x8
--- trap 0, eip = 0, esp = 0xe36f8d70, ebp = 0 ---
lock order reversal:
 1st 0xc4ce7e90 devfs (devfs) _at_ /usr/src/sys/kern/vfs_subr.c:2046
 2nd 0xc4cd7954 devfsmount (devfsmount) _at_
/usr/src/sys/fs/devfs/devfs_vnops.c:201
KDB: stack backtrace:
db_trace_self_wrapper(c07d6161,e36f8bb4,c05fe64e,c07d8861,c4cd7954,...)
at db_trace_self_wrapper+0x26
kdb_backtrace(c07d8861,c4cd7954,c07c8ae6,c07c8ae6,c07c8b27,...) at
kdb_backtrace+0x29
witness_checkorder(c4cd7954,9,c07c8b27,c9,c7,...) at witness_checkorder+0x6de
_sx_xlock(c4cd7954,0,c07c8b27,c9,c4cd7954,...) at _sx_xlock+0x7d
devfs_allocv(c4dfc280,c4e8d000,e36f8c20,c4b1ccc0,c4b1cd64,...) at
devfs_allocv+0x142
devfs_root(c4e8d000,80000,c08a72d8,c4b1ccc0,4,...) at devfs_root+0x51
set_rootvnode(c08a72c0,0,c07de689,5f6,c063b1b0,...) at set_rootvnode+0x2d
vfs_mountroot(c0854dd0,4,c07cdfa9,264,c,...) at vfs_mountroot+0x34c
start_init(0,e36f8d38,c07cf8fb,30d,c4b1acf8,...) at start_init+0x65
fork_exit(c0589e00,0,e36f8d38) at fork_exit+0xb8
fork_trampoline() at fork_trampoline+0x8
--- trap 0, eip = 0, esp = 0xe36f8d70, ebp = 0 ---
Trying to mount root from ufs:/dev/ad8s1a
WARNING: / was not properly dismounted
lock order reversal: (sleepable after non-sleepable)
 1st 0xc4ce7ba0 bufobj interlock (bufobj interlock) _at_
/usr/src/sys/kern/vfs_bio.c:2442
 2nd 0xd8b85088 bufwait (bufwait) _at_ /usr/src/sys/kern/vfs_bio.c:2456
KDB: stack backtrace:
db_trace_self_wrapper(c07d6161,e36f8790,c05fe64e,c07d8861,d8b85088,...)
at db_trace_self_wrapper+0x26
kdb_backtrace(c07d8861,d8b85088,c07dd67b,c07dd67b,c07dcbdf,...) at
kdb_backtrace+0x29
witness_checkorder(d8b85088,9,c07dcbdf,998,4,...) at witness_checkorder+0x6de
__lockmgr_args(d8b85088,81900,c4ce7ba0,c07dd5d7,50,...) at __lockmgr_args+0x777
getblk(c4ce7af0,0,0,800,0,...) at getblk+0x153
breadn(c4ce7af0,0,0,800,0,...) at breadn+0x44
bread(c4ce7af0,0,0,800,0,...) at bread+0x4c
ffs_blkatoff(c4ce7af0,0,0,0,e36f89a8,...) at ffs_blkatoff+0xd1
ufs_lookup(e36f89ec,c4ce7af0,e36f8b50,c4ce7af0,e36f8a0c,...) at ufs_lookup+0x2b5
VOP_CACHEDLOOKUP_APV(c082b420,e36f89ec,e36f8b50,e36f8b3c,c4b21800,...)
at VOP_CACHEDLOOKUP_APV+0xa5
vfs_cache_lookup(e36f8a6c,e36f8a6c,500000c,80000,c4ce7af0,...) at
vfs_cache_lookup+0xd0
VOP_LOOKUP_APV(c082b420,e36f8a6c,c07de437,1b0,e36f8b3c,...) at
VOP_LOOKUP_APV+0xa5
lookup(e36f8b24,c07de437,d8,c0,c4af322c,...) at lookup+0x56e
namei(e36f8b24,e36f8b28,c05fde2c,c05b4ccc,c08a6b30,...) at namei+0x44b
kern_unlinkat(c4b1ccc0,ffffff9c,c07deac9,1,e36f8c5c,...) at kern_unlinkat+0x46
kern_unlink(c4b1ccc0,c07deac9,1,631,0,...) at kern_unlink+0x27
vfs_mountroot_try(c07dec83,c07ccc8b,c07c6c1c,1,c063b1b0,...) at
vfs_mountroot_try+0x472
vfs_mountroot(c0854dd0,4,c07cdfa9,264,c,...) at vfs_mountroot+0x40e
start_init(0,e36f8d38,c07cf8fb,30d,c4b1acf8,...) at start_init+0x65
fork_exit(c0589e00,0,e36f8d38) at fork_exit+0xb8
fork_trampoline() at fork_trampoline+0x8
--- trap 0, eip = 0, esp = 0xe36f8d70, ebp = 0 ---
WARNING: / was not properly dismounted
WARNING: /var was not properly dismounted
/var: mount pending error: blocks 64 files 14
WARNING: TMPFS is considered to be a highly experimental feature in FreeBSD.
acd0: FAILURE - INQUIRY ILLEGAL REQUEST asc=0x24 ascq=0x00
cd0 at ata4 bus 0 target 1 lun 0
cd0: <SONY DVD RW DRU-800A KY06> Removable CD-ROM SCSI-0 device
cd0: 66.000MB/s transfers
cd0: Attempt to query device size failed: NOT READY, Medium not present