In article <20010813214012.22B807B76@berkshire.research.att.com>
smb@research.att.com wrote:

> Aug 13 09:48:15 berkshire /netbsd: panic: pool_get(mclpl): free list modified: magic=a020beef; page 0xd2269000; item addr 0xd2269800
> Aug 13 09:48:15 berkshire /netbsd: 
> Aug 13 09:48:15 berkshire /netbsd: Begin traceback...
> Aug 13 09:48:15 berkshire /netbsd: _pool_get(c0477680,0,c0392a42,662,c0990800) at _pool_get+0x4f0
> Aug 13 09:48:15 berkshire /netbsd: fxp_add_rfabuf(c0991000,c0994240,1,c0992e60,d287bb20) at fxp_add_rfabuf+0xf1
> Aug 13 09:48:15 berkshire /netbsd: fxp_intr(c0991000) at fxp_intr+0x590

How about the attached patch?
I saw the similar panic. I'm afraid there are some race conditions
when fxp runs out of its RFAs, but I cannot reproduce the panic
any longer...

--- i82557var.h.orig	Tue Aug 14 13:17:28 2001
+++ i82557var.h	Tue Aug 14 13:17:32 2001
@@ -294,7 +294,8 @@
 	__rfa->size = htole16(FXP_RXBUFSIZE((sc), (m)));		\
 	/* BIG_ENDIAN: no need to swap to store 0 */			\
 	__rfa->rfa_status = 0;						\
-	__rfa->rfa_control = htole16(FXP_RFA_CONTROL_EL);		\
+	__rfa->rfa_control =						\
+	    htole16(FXP_RFA_CONTROL_EL|FXP_RFA_CONTROL_S);		\
 	/* BIG_ENDIAN: no need to swap to store 0 */			\
 	__rfa->actual_size = 0;						\
 									\
@@ -317,7 +318,8 @@
 		    BUS_DMASYNC_POSTREAD|BUS_DMASYNC_POSTWRITE);	\
 		memcpy((void *)&__p_rfa->link_addr, &__v,		\
 		    sizeof(__v));					\
-		__p_rfa->rfa_control &= htole16(~FXP_RFA_CONTROL_EL);	\
+		__p_rfa->rfa_control &=					\
+		    htole16(~(FXP_RFA_CONTROL_EL|FXP_RFA_CONTROL_S));	\
 		FXP_RFASYNC((sc), __p_m,				\
 		    BUS_DMASYNC_PREREAD|BUS_DMASYNC_PREWRITE);		\
 	}								\