Fatal page fault in cbq_enqueue()

[Paul Ripke <stix%stix.id.au@localhost>]

I've had a handful of these, unfortunately I don't have a matching
debug kernel and dump. Just wondering if anyone else has seen this
or has any idea? Guessing spl race somewhere? What's the state of
altq?

Kernel is:
NetBSD slave 7.0_STABLE NetBSD 7.0_STABLE (SLAVE) #0: Thu Mar 31 10:32:02 AEDT 2016
stix@slave:/home/netbsd/netbsd-7/obj.amd64/home/netbsd/netbsd-7/src/sys/arch/amd64/compile/SLAVE amd64

May 14 12:42:17 slave /netbsd: fatal page fault in supervisor mode
May 14 12:42:17 slave /netbsd: trap type 6 code 0 rip ffffffff80179806 cs 8 rflags 10286 cr2 8 ilevel 6 rsp fffffe80400059b0
May 14 12:42:17 slave /netbsd: curlwp 0xfffffe811f938420 pid 0.3 lowest kstack 0xfffffe80400032c0
May 14 12:42:17 slave /netbsd: panic: trap
May 14 12:42:17 slave /netbsd: cpu0: Begin traceback...
May 14 12:42:17 slave /netbsd: vpanic() at netbsd:vpanic+0x13c
May 14 12:42:17 slave /netbsd: snprintf() at netbsd:snprintf
May 14 12:42:17 slave /netbsd: startlwp() at netbsd:startlwp
May 14 12:42:17 slave /netbsd: alltraps() at netbsd:alltraps+0x96
May 14 12:42:17 slave /netbsd: cbq_enqueue() at netbsd:cbq_enqueue+0x8f
May 14 12:42:17 slave /netbsd: ifq_enqueue2() at netbsd:ifq_enqueue2+0xeb
May 14 12:42:17 slave /netbsd: sppp_output() at netbsd:sppp_output+0x1d8
May 14 12:42:17 slave /netbsd: nd6_output() at netbsd:nd6_output+0x11d
May 14 12:42:17 slave /netbsd: ipf_fastroute() at netbsd:ipf_fastroute+0x82b
May 14 12:42:17 slave /netbsd: ipf_send_ip() at netbsd:ipf_send_ip+0x13c
May 14 12:42:17 slave /netbsd: ipf_check() at netbsd:ipf_check+0xe7f
May 14 12:42:17 slave /netbsd: pfil_run_hooks() at netbsd:pfil_run_hooks+0xc4
May 14 12:42:17 slave /netbsd: ip6_input() at netbsd:ip6_input+0x2a5
May 14 12:42:17 slave /netbsd: ip6intr() at netbsd:ip6intr+0x45
May 14 12:42:17 slave /netbsd: softint_dispatch() at netbsd:softint_dispatch+0x79
May 14 12:42:17 slave /netbsd: DDB lost frame for netbsd:Xsoftintr+0x4f, trying 0xfffffe8040005ff0
May 14 12:42:17 slave /netbsd: Xsoftintr() at netbsd:Xsoftintr+0x4f
May 14 12:42:17 slave /netbsd: --- interrupt ---
May 14 12:42:17 slave /netbsd: 0:
May 14 12:42:17 slave /netbsd: cpu0: End traceback...

afaict, cbq_enqueue+0x8f puts it around about the m_tag_find call. I've
also had a panic or two in cbq_dequeue:

Mar 15 18:23:48 slave /netbsd: panic: _rmc_wrr_dequeue_next
Mar 15 18:23:48 slave /netbsd: cpu0: Begin traceback...
Mar 15 18:23:48 slave /netbsd: vpanic() at netbsd:vpanic+0x13c
Mar 15 18:23:48 slave /netbsd: snprintf() at netbsd:snprintf
Mar 15 18:23:48 slave /netbsd: rmc_dequeue_next() at netbsd:rmc_dequeue_next+0x4fd
Mar 15 18:23:48 slave /netbsd: cbq_dequeue() at netbsd:cbq_dequeue+0x27
Mar 15 18:23:48 slave /netbsd: tbr_dequeue() at netbsd:tbr_dequeue+0x72
Mar 15 18:23:48 slave /netbsd: sppp_dequeue() at netbsd:sppp_dequeue+0x111
Mar 15 18:23:48 slave /netbsd: pppoe_start() at netbsd:pppoe_start+0x30
Mar 15 18:23:48 slave /netbsd: tbr_timeout() at netbsd:tbr_timeout+0x4e
Mar 15 18:23:48 slave /netbsd: callout_softclock() at netbsd:callout_softclock+0x248
Mar 15 18:23:48 slave /netbsd: softint_dispatch() at netbsd:softint_dispatch+0x79
Mar 15 18:23:48 slave /netbsd: DDB lost frame for netbsd:Xsoftintr+0x4f, trying 0xfffffe804
000bff0
Mar 15 18:23:48 slave /netbsd: Xsoftintr() at netbsd:Xsoftintr+0x4f

-- 
Paul Ripke
"Great minds discuss ideas, average minds discuss events, small minds
 discuss people."
-- Disputed: Often attributed to Eleanor Roosevelt. 1948.