LOR: so_snd_sx vs bufwait

Hi.

This is a FreeBSD 9.0-CURRENT i386. The LOR was caught via stress2 suite.
I guess sblock() (uipc_sockbuf.c:148 here) was called from sosend_generic()
(which is at line uipc_socket.c:1436).

lock order reversal:
 1st 0xc836d5f4 so_snd_sx (so_snd_sx) _at_ /usr/src/sys/kern/uipc_sockbuf.c:148
 2nd 0xd98e80dc bufwait (bufwait) _at_ /usr/src/sys/vm/vm_pager.c:311
KDB: stack backtrace:
db_trace_self_wrapper(c07fd8ea,e88376a8,c060a145,c05fac1b,c08008bf,...) at db_tr
ace_self_wrapper+0x26
kdb_backtrace(c05fac1b,c08008bf,c58ea8a8,c58e6ef8,e8837704,...) at kdb_backtrace
+0x29
_witness_debugger(c08008bf,d98e80dc,c0806261,c58e6ef8,c081a6b1,...) at _witness_
debugger+0x25
witness_checkorder(d98e80dc,9,c081a6b1,137,0,...) at witness_checkorder+0x839
__lockmgr_args(d98e80dc,80000,0,0,0,...) at __lockmgr_args+0x7b7
initpbuf(c0a046c0,0,c081a6b1,162,2,...) at initpbuf+0xe0
getpbuf(c0a03f10,0,c0817667,47d,c07f8d78,...) at getpbuf+0x12f
swap_pager_getpages(c65f5000,e8837914,2,1,e8837998,...) at swap_pager_getpages+0
x201
vm_fault(c64d1e80,28229000,1,0,28229090,...) at vm_fault+0xf7f
trap_pfault(5,0,c0824a58,c0609eeb,c7885aa0,...) at trap_pfault+0xf9
trap(e8837a90) at trap+0x473
calltrap() at calltrap+0x6
--- trap 0xc, eip = 0xc079f412, esp = 0xe8837ad0, ebp = 0xe8837b08 ---
generic_copyin(c83c7018,10,e8837c58,1,0,...) at generic_copyin+0x32
m_uiotombuf(e8837c58,2,37a0,0,0,...) at m_uiotombuf+0xf6
sosend_generic(c836d4d4,0,e8837c58,0,0,...) at sosend_generic+0x432
sosend(c836d4d4,0,e8837c58,0,0,...) at sosend+0x3f
soo_write(c643d7e0,e8837c58,c5e62700,0,c716c480,...) at soo_write+0x63
dofilewrite(e8837c58,ffffffff,ffffffff,0,c643d7e0,...) at dofilewrite+0x95
kern_writev(c716c480,3,e8837c58,e8837c78,1,...) at kern_writev+0x58
write(c716c480,e8837cf8,c,e8837cc8,c0846190,...) at write+0x4f
syscall(e8837d38) at syscall+0x2b4
Xint0x80_syscall() at Xint0x80_syscall+0x20
--- syscall (4, FreeBSD ELF32, write), eip = 0x2818d2c3, esp = 0xbfbfe8bc, ebp =
 0xbfbfe908 ---

-- 
wbr,
pluknet