kernel panic with snd_hda "panic: Duplicate free of item 0xffffff00025f8c00 from zone 0xffffff00b697d400(1024)"

Hi Alexander and all,

I'm getting a kernel panic with the snd_hda driver on fresh 8-CURRENT 
amd64 (r190518). I received this panic the other day when loading the 
module from the command line on a slightly older kernel revision (I 
think it was r190437). After putting the module load into 
/boot/loader.conf, the problem didn't occur again and sound worked just 
fine on subsequent reboots.

A few minutes ago I installed the new r190518 kernel and now it panics 
consistently with the same message every time. It also panics if I 
unload the module at the loader prompt, boot the kernel and then kldload 
on the command line.

Hardware is a Toshiba Portege R600 laptop. Details below are hand 
transcribed as the machine doesn't have a serial port.

Relevant bit of verbose boot message when it panics:

hdac0: <Intel 82801I High Definition Audio Controller> at device 27.0 on
        pci0
hdac0: HDA driver revision: 20090316_0130
hdac0: Lazy allocation of 0x4000 bytes rid 0x10 type 3 at 0xb69a4000
hdac0: Reserved 0x4000 bytes for rid 0x10 type 3 at 0xb69a4000
hdac0: attempting to allocate 1 MSI vectors (1 supported)
hdac0: using IRQ 257 for MSI
msi: Assinging MSI IRQ 257 to local APIC 0 vector 53
hdac0: [MPSAFE]
hdac0: [ITHREAD]
hdac0: hdac_get_capabilities: Invalid corb size (0)
device_attach: hdac0 attach returned 6
Slab at 0xffffff00025d5b18, freei 3 = 0.
panic: Duplicate free of item 0xffffff00025f8c00 from zone 
0xffffff00b697d400(1024)


Backtrace at the ddb prompt looks like this:

db> bt
kdb_enter()+0x3d
panic()+0x17b
uma_dbg_free()+0x171
uma_zfree_arg()+0x68
free()+0xbd
device_set_driver()+0x8e
device_attach()+0x19b
bus_generic_attach()+0x1a
acpi_pci_attach()+0x147
device_attach()+0x69
bus_generic_attach()+0x1a
acpi_pcib_attach()+0x1a7
acpi_pcib_acpi_attach()+0x1a5
device_attach()+0x69
bus_generic_attach()+0x1a
acpi_attach()+0x9e4
device_attach()+0x69
bus_generic_attach()+0x1a
device_attach()+0x69
root_bus_configure()+0x28
configure()+0xa
mi_startup()+0x59
btext()+0x2c


Relevant pciconf output:

none1_at_pci0:0:27:0:      class=0x040300 card=0x00011179 chip=0x293e8086 
rev=0x03 hdr=0x00
     vendor     = 'Intel Corporation' 

     device     = '82801IB/IR/IH (ICH9 Family) HD Audio Controller' 

     class      = multimedia 

     subclass   = HDA 

     cap 01[50] = powerspec 2  supports D0 D3  current D0 

     cap 05[60] = MSI supports 1 message, 64 bit 

     cap 10[70] = PCI-Express 1 type 0



Any idea what the issue(s) might be?

Cheers,
Lawrence