Quoting Dave Huang,

> Hi, I've got a 4MB 386 that seems to crash if I try to ftp while it's
> paging/thrashing (and with 4MB of RAM, it thrashes fairly often :) I don't
> normally have a monitor hooked up to it, and I don't have DDB in the
> kernel, so all I get is a "savecore: reboot after panic: trap" message in
> /var/log/messages. Shouldn't the diagnostic info it prints before it
> panics get logged too? Anyways, I hooked a monitor up to it and was able
> to get it to panic again... it says:

[...]

> And tf_eip (0xf814f457) is in pppstart (../../../../net/ppp_tty.c:673):
> 672                 /* Finished with this mbuf; free it and move on. */
> 673                 MFREE(m, m2);
> 674                 m = m2;

[...]

> and tf_eip (0xf816256c) is in tcp_fasttimo
> (../../../../netinet/tcp_timer.c:82):
> 81                  inp = inp->inp_queue.cqe_next) {
> 82                      if ((tp = (struct tcpcb *)inp->inp_ppcb) &&
> 83                          (tp->t_flags & TF_DELACK)) {


That looks like something is doing packet queueing at the wrong spl level.
Can't see what it is at the moment. The latest few changes of splhigh->splimp
may have triggered this. Are people on other architectures than the i386
seeing this as well?

- Frank