8.0-BETA3 reproducible panic under load

I'm testing FreeBSD 8.0-BETA3 on two machines, one of which is stable, one 
of which panics every couple of minutes when put under heavy HTTP load. 
It's usually this panic, though I've seen udpinp+snmpd get implicated too.

I have a crash dump for this and four other panics -- though I'm not great 
with kgdb, so if someone can let me know (off-list if they want) what they 
need to debug this one...


Kernel page fault with the following non-sleepable locks held:
exclusive rw tcpinp (tcpinp) r = 0 (0xffffff00a74aabb0) locked _at_ /usr/src/sys/netinet/tcp_usrreq.c:758
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0x2a
_witness_debugger() at _witness_debugger+0x49
witness_warn() at witness_warn+0x2ba
trap() at trap+0x2c2
calltrap() at calltrap+0x8
--- trap 0xc, rip = 0xffffffff80315166, rsp = 0xffffff80ecfd96f0, rbp = 0xffffff80ecfd9720 ---
_rw_wlock() at _rw_wlock+0x24
ip_output() at ip_output+0x9a5
tcp_output() at tcp_output+0xa7b
tcp_usr_send() at tcp_usr_send+0x2e0
sosend_generic() at sosend_generic+0x289
soo_write() at soo_write+0x50
dofilewrite() at dofilewrite+0x7a
kern_writev() at kern_writev+0x52
writev() at writev+0x3a
syscall() at syscall+0x1af
Xfast_syscall() at Xfast_syscall+0xe1
--- syscall (121, FreeBSD ELF64, writev), rip = 0x80131efdc, rsp = 0x7fffffffc258, rbp = 0x80a3d90a8 ---


Fatal trap 12: page fault while in kernel mode
cpuid = 3; apic id = 03
fault virtual address   = 0x28
fault code              = supervisor read data, page not present
instruction pointer     = 0x20:0xffffffff80315166
stack pointer           = 0x28:0xffffff80ecfd96f0
frame pointer           = 0x28:0xffffff80ecfd9720
code segment            = base 0x0, limit 0xfffff, type 0x1b
                         = DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags        = interrupt enabled, resume, IOPL = 0
current process         = 1222 (httpd)
trap number             = 12
panic: page fault
cpuid = 3
Uptime: 1m39s