I seem to be able to reliably panic by running bonnie on an LFS
filesystem created with 'newfs_lfs -A'.  NetBSD/i386 1.5W, kernel built
from source as of today.

$ sudo newfs_lfs -A /dev/rsd2d
bandwidth 14562099 B/s, seek time 7 ms (126 seeks/s)
using initial segment size 524288
17366.0MB in 34732 segments of size 524288
Using 1 single indirect block(s) for inode 1
super-block backups (for fsck -b #) at:
16, 3556368, 7112720, 10669072, 14225424, 17781776, 21338128, 24894480, 28450832, 32007184 
$ sudo mount /dev/sd2d /mnt
$ cd /mnt
$ sudo bonnie
File './Bonnie.341', size: 104857600
Writing with putc()...done
Rewriting...

lfs_truncate: segment 207 short by 458752
panic: lfs_truncate: negative bytes
Stopped in pid 341 (bonnie) at  cpu_Debugger+0x4:       leave
db> t
cpu_Debugger(70000,c0c38000,cf,d8477c00,c03278c9) at cpu_Debugger+0x4
panic(c049f328,c049f300,cf,70000,2000) at panic+0x8e
lfs_update_seguse(c0c38000,cf,70000,0,1bb) at lfs_update_seguse+0x95
lfs_blkfree(c0c38000,33c08,2000,d8477db0,d8477db4) at lfs_blkfree+0x59
lfs_indirtrunc(d846f1b8,ffffcff4,642d2,ffffffff,0) at lfs_indirtrunc+0x32e
lfs_indirtrunc(d846f1b8,fffff7f3,642f2,ffffffff,1) at lfs_indirtrunc+0x2fe
lfs_truncate(d8477e28,d846f1b8,d7f57140,0,c0489be0) at lfs_truncate+0x7a2
VOP_TRUNCATE(d7f57140,0,0,0,ffffffff) at VOP_TRUNCATE+0x46
ufs_inactive(d8477e8c,d8477e98,c022cab3,d8477e8c,c0489820) at ufs_inactive+0x8b
lfs_inactive(d8477e8c,c0489820,d7f57140,d7f3c724,d8477eb0) at lfs_inactive+0x2f
VOP_INACTIVE(d7f57140,d7f3c724,d7f57140,d847bde4,d8477edc) at VOP_INACTIVE+0x2b
vrele(d7f57140,c05a5d4c,d7f57140,d847bde4,d8477eec) at vrele+0xa2
lfs_remove(d8477eec,d7f57140,c04895c0,d847bde4,d7f57140) at lfs_remove+0xf6
VOP_REMOVE(d847bde4,d7f57140,d8477f3c,d8477f80,d7f3c724) at VOP_REMOVE+0x32
sys_unlink(d7f3c724,d8477f88,d8477f80) at sys_unlink+0xac
syscall_plain(1f,bfbf001f,200,bfbf973c,bfbf86ec) at syscall_plain+0x98