sysctl panic on cold boot

Hi,

since r247617 my notebook consistently crashes with a page fault when I
turn it on. If I then reboot from the debugger, the system will boot
just fine. The last known working revision is r247186. I tried backing
out r247561 as this last touched kern_sysctl.c, but to no avail. This
is on amd64.

As can be seen below, gdb isn't really a big help. Does anyone know
what's going on?

[...]
<118>Entropy harvesting: interrupts ethernet point_to_point


Fatal trap 12: page fault while in kernel mode
cpuid = 0; apic id = 00
fault virtual address   = 0x1011e
fault code              = supervisor read data, page not present
instruction pointer     = 0x20:0xffffffff804a15c0
stack pointer           = 0x28:0xffffff811561c670
frame pointer           = 0x28:0xffffff811561c6e0
code segment            = base 0x0, limit 0xfffff, type 0x1b
                        = DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags        = interrupt enabled, resume, IOPL = 0
current process         = 47 (sysctl)

Reading symbols from /boot/kernel/if_iwn.ko...Reading symbols from /boot/kernel/if_iwn.ko.symbols...done.
done.
Loaded symbols for /boot/kernel/if_iwn.ko
Reading symbols from /boot/kernel/iwn5000fw.ko...Reading symbols from /boot/kernel/iwn5000fw.ko.symbols...done.
done.
Loaded symbols for /boot/kernel/iwn5000fw.ko
Reading symbols from /boot/modules/nvidia.ko...done.
Loaded symbols for /boot/modules/nvidia.ko
Reading symbols from /boot/kernel/linux.ko...Reading symbols from /boot/kernel/linux.ko.symbols...done.
done.
Loaded symbols for /boot/kernel/linux.ko
#0  doadump (textdump=0) at pcpu.h:229
229     pcpu.h: No such file or directory.
        in pcpu.h
(kgdb) bt
#0  doadump (textdump=0) at pcpu.h:229
#1  0xffffffff802c0bbe in db_dump (dummy=<value optimized out>, dummy2=0, 
    dummy3=0, dummy4=0x0) at /usr/src/sys/ddb/db_command.c:543
#2  0xffffffff802c06ba in db_command (last_cmdp=<value optimized out>, 
    cmd_table=<value optimized out>, dopager=1)
    at /usr/src/sys/ddb/db_command.c:449
#3  0xffffffff802c0472 in db_command_loop ()
    at /usr/src/sys/ddb/db_command.c:502
#4  0xffffffff802c2dc0 in db_trap (type=<value optimized out>, code=0)
    at /usr/src/sys/ddb/db_main.c:231
#5  0xffffffff804cad23 in kdb_trap (type=12, code=0, tf=<value optimized out>)
    at /usr/src/sys/kern/subr_kdb.c:654
#6  0xffffffff806fd1c5 in trap_fatal (frame=0xffffff811561c5c0, 
    eva=<value optimized out>) at /usr/src/sys/amd64/amd64/trap.c:867
#7  0xffffffff806fd466 in trap_pfault (frame=0x0, usermode=0)
    at /usr/src/sys/amd64/amd64/trap.c:698
#8  0xffffffff806fccba in trap (frame=0xffffff811561c5c0)
    at /usr/src/sys/amd64/amd64/trap.c:463
#9  0xffffffff806e6eb3 in calltrap () at exception.S:228
#10 0xffffffff804a15c0 in sysctl_sysctl_next_ls (lsp=<value optimized out>, 
    name=0xffffff811561ca44, namelen=<value optimized out>, 
    next=0xffffff811561c85c, len=0xffffff811561c8c4, level=4)
    at /usr/src/sys/kern/kern_sysctl.c:745
---Type <return> to continue, or q <return> to quit---
#11 0xffffffff804a16ce in sysctl_sysctl_next_ls (lsp=0xfffffe0002a335b0, 
    name=0xffffff811561ca40, namelen=<value optimized out>, 
    next=0xffffff811561c858, len=0xffffff811561c8c4, level=3)
    at /usr/src/sys/kern/kern_sysctl.c:772
#12 0xffffffff804a16ce in sysctl_sysctl_next_ls (lsp=0xfffffe0002a335b0, 
    name=0xffffff811561ca3c, namelen=<value optimized out>, 
    next=0xffffff811561c854, len=0xffffff811561c8c4, level=2)
    at /usr/src/sys/kern/kern_sysctl.c:772
#13 0xffffffff804a16ce in sysctl_sysctl_next_ls (lsp=0xfffffe0002a335b0, 
    name=0xffffff811561ca38, namelen=<value optimized out>, 
    next=0xffffff811561c850, len=0xffffff811561c8c4, level=1)
    at /usr/src/sys/kern/kern_sysctl.c:772
#14 0xffffffff804a1513 in sysctl_sysctl_next (oidp=<value optimized out>, 
    arg1=0xffffff811561ca38, arg2=4, req=0xffffff811561c968)
    at /usr/src/sys/kern/kern_sysctl.c:794
#15 0xffffffff804a090d in sysctl_root (arg1=<value optimized out>, 
    arg2=<value optimized out>) at /usr/src/sys/kern/kern_sysctl.c:1493
#16 0xffffffff804a0ea8 in userland_sysctl (td=<value optimized out>, 
    name=0xffffff811561ca30, namelen=<value optimized out>, 
    old=<value optimized out>, oldlenp=<value optimized out>, 
    inkernel=<value optimized out>, new=<value optimized out>, 
    newlen=<value optimized out>, retval=<value optimized out>, 
    flags=358730064) at /usr/src/sys/kern/kern_sysctl.c:1603
---Type <return> to continue, or q <return> to quit---

#17 0xffffffff804a0c94 in sys___sysctl (td=0xfffffe0006037920, 
    uap=0xffffff811561cb40) at /usr/src/sys/kern/kern_sysctl.c:1529
#18 0xffffffff806fd88e in amd64_syscall (td=0xfffffe0006037920, traced=0)
    at subr_syscall.c:134
#19 0xffffffff806e719b in Xfast_syscall () at exception.S:387
#20 0x000000080094a30a in ?? ()
Previous frame inner to this frame (corrupt stack?)
Current language:  auto; currently minimal
(kgdb) f 10
#10 0xffffffff804a15c0 in sysctl_sysctl_next_ls (lsp=<value optimized out>, 
    name=0xffffff811561ca44, namelen=<value optimized out>, 
    next=0xffffff811561c85c, len=0xffffff811561c8c4, level=4)
    at /usr/src/sys/kern/kern_sysctl.c:745
745                             if (!sysctl_sysctl_next_ls(lsp, 0, 0, next+1, 
(kgdb) l
740                                     return (0);
741                             if (oidp->oid_handler) 
742                                     /* We really should call the handler here...*/
743                                     return (0);
744                             lsp = SYSCTL_CHILDREN(oidp);
745                             if (!sysctl_sysctl_next_ls(lsp, 0, 0, next+1, 
746                                     len, level+1, oidpp))
747                                     return (0);
748                             goto emptynode;
749                     }
(kgdb) p lsp
$1 = <value optimized out>
(kgdb) p next
$2 = (int *) 0xffffff811561c85c
(kgdb) p oidp
No symbol "oidp" in current context.
(kgdb) p oidpp
Cannot access memory at address 0x0
(kgdb) p name
$3 = (int *) 0xffffff811561ca44
(kgdb) p len
$4 = (int *) 0xffffff811561c8c4
(kgdb) p level
$5 = 4

Stefan