The following reply was made to PR kern/35071; it has been noted by GNATS.

From: Tracy Di Marco White <tjd-nb-pr@menelos.com>
To: gnats-bugs@NetBSD.org
Cc: 
Subject: Re: kern/35071: panic: mpt_get_request: corrupted request free list (xfer) 
Date: Sat, 18 Nov 2006 04:51:40 -0600

 I meant to include the console message prior to the panic, and show
 uvm after.
 mpt3: mpt_done: no scsipi_xfer, index = 0xfd, seq = 0x00000000
 mpt3: request state: Free
 mpt3: mpt_request:
 SCSI IO Request @ 0xcf5cd64c
         Chain Offset  0x10
         MsgFlags      0x00
         MsgContext    0x000000fd
         Bus:                0
         TargetID            1
         SenseBufferLength   32
         LUN:              0x0
         Control           0x01000500  WRITE  UNTAGGED 
         DataLength      0x00010000
         SenseBufAddr    0x04798be0
         CDB[0:6]        0a 00 01 00 00 00 
         SE32 0xce558a30: Addr=0xb3917008 FlagsLength=0x14000ff8
          HOST_TO_IOC
         SE32 0xce558a38: Addr=0x27318000 FlagsLength=0x94001000
          HOST_TO_IOC LAST_ELEMENT
         CE32 0xce558a40: Addr=0x4798a48 NxtChnO=0x16 Flgs=0x30 Len=0x60
         SE32 0xce558a48: Addr=0x5f279000 FlagsLength=0x14001000
          HOST_TO_IOC
         SE32 0xce558a50: Addr=0x95a3a000 FlagsLength=0x14001000
          HOST_TO_IOC
         SE32 0xce558a58: Addr=0x6653b000 FlagsLength=0x14001000
          HOST_TO_IOC
         SE32 0xce558a60: Addr=0x7ef9c000 FlagsLength=0x14001000
          HOST_TO_IOC
         SE32 0xce558a68: Addr=0x9705d000 FlagsLength=0x14001000
          HOST_TO_IOC
         SE32 0xce558a70: Addr=0x4263e000 FlagsLength=0x14001000
          HOST_TO_IOC
         SE32 0xce558a78: Addr=0x3617f000 FlagsLength=0x14001000
          HOST_TO_IOC
         SE32 0xce558a80: Addr=0x6e7c0000 FlagsLength=0x14001000
          HOST_TO_IOC
         SE32 0xce558a88: Addr=0x80241000 FlagsLength=0x14001000
          HOST_TO_IOC
         SE32 0xce558a90: Addr=0x67be2000 FlagsLength=0x14001000
          HOST_TO_IOC
         SE32 0xce558a98: Addr=0x82ea3000 FlagsLength=0x94001000
          HOST_TO_IOC LAST_ELEMENT
         CE32 0xce558aa0: Addr=0x4798aa8 NxtChnO=0x0 Flgs=0x30 Len=0x20
         SE32 0xce558aa8: Addr=0x28ac4000 FlagsLength=0x14001000
          HOST_TO_IOC
         SE32 0xce558ab0: Addr=0x42325000 FlagsLength=0x14001000
          HOST_TO_IOC
         SE32 0xce558ab8: Addr=0xca566000 FlagsLength=0x14001000
          HOST_TO_IOC
         SE32 0xce558ac0: Addr=0xac0a7000 FlagsLength=0xd5000008
          HOST_TO_IOC LAST_ELEMENT END_OF_BUFFER END_OF_LIST
 mpt3: mpt_reply:
 SCSI IO Request Reply @ 0xce38f380
         IOC Status    Success
         IOCLogInfo    0x00000000
         MsgLength     0x08
         MsgFlags      0x00
         MsgContext    0x000000fd
         Bus:          0
         TargetID      2
         CDBLength     6
         SCSI Status:  Check Condition
         SCSI State:   (0x00000001)AutoSense_Valid 
         TransferCnt   0x0000
         SenseCnt      0x001c
         ResponseInfo  0x00000000
 panic: mpt_get_request: corrupted request free list (xfer)
 
 Stopped in pid 21393.1 (tibsmnt) at     netbsd:cpu_Debugger+0x4:        leave
 db>  t
 cpu_Debugger(dcb8fa48,10002,0,cf2c2828,c4bc9400) at netbsd:cpu_Debugger+0x4
 panic(c08317f8,6,da8b96a4,0,1) at netbsd:panic+0x141
 mpt_get_request(c4bc9400,10002,cf2c286c,c042a7f0,dcb8f9d8) at netbsd:mpt_get_request+0x5b
 mpt_scsipi_request(c4bc96dc,0,c4298f44,0,cf2c2900) at netbsd:mpt_scsipi_request+0x4d
 scsipi_run_queue(da8b96a4,0,c4d65100,c4bc96dc,0) at netbsd:scsipi_run_queue+0x184
 scsipi_execute_xs(c4298f44,cf2c2982,6,0,0) at netbsd:scsipi_execute_xs+0x17e
 scsipi_test_unit_ready(c4d65100,a0,0,dcb8f9d8,dcb8f9d8) at netbsd:scsipi_test_unit_ready+0x4d
 stopen(e11,801,2000,dd9ff4ec,dcb8f9d8) at netbsd:stopen+0xd6
 spec_open(cf2c2a78,cf31cb58,4d2,0,4d2) at netbsd:spec_open+0x1df
 VOP_OPEN(dcb8f9d8,801,cf31cb58,dd9ff4ec,dd9ff4ec) at netbsd:VOP_OPEN+0x2f
 vn_open(cf2c2b68,801,d60,dd9ff4ec,c0886444) at netbsd:vn_open+0x266
 sys_open(dd9ff4ec,cf2c2c00,cf2c2c68,bba50000,23) at netbsd:sys_open+0xa0
 linux_sys_open(dd9ff4ec,cf2c2c48,cf2c2c68,8563f70,8050000) at netbsd:linux_sys_open+0x70
 linux_syscall_plain(cf2c2c88,bba7002b,bba7002b,bfbf002b,bbbf002b) at netbsd:linux_syscall_plain+0xa8
 db> show uvm
 Current UVM status:
   pagesize=4096 (0x1000), pagemask=0xfff, pageshift=12
   900981 VM pages: 555299 active, 272631 inactive, 1250 wired, 2823 free
   min  10% (25) anon, 30% (76) file, 5% (12) exec
   max  15% (38) anon, 80% (204) file, 30% (76) exec
   pages  117901 anon, 707980 file, 3627 exec
   freemin=64, free-target=85, inactive-target=272631, wired-max=300327
   faults=-2134302039, traps=1541685497, intrs=186871550, ctxswitch=305568730
   softint=115212963, syscalls=1890254534, swapins=25698, swapouts=25721
   fault counts:
     noram=2470, noanon=0, pgwait=21, pgrele=0
     ok relocks(total)=386581(386609), anget(retrys)=879286551(359538), amapcopy=39404854
     neighbor anon/obj pg=35382378/392159854, gets(lock/unlock)=114677177/27055
     cases: anon=859097219, anoncow=13780464, obj=96111232, prcopy=18565921, przero=461640788
   daemon and swap counts:
     woke=1563139, revs=1559493, scans=512965763, obscans=484154054, anscans=600471
     busy=74778, freed=484754525, reactivate=5476456, deactivate=520377365
     pageouts=49971, pending=522177, nswget=359620
     nswapdev=1, swpgavail=264554
     swpages=264554, swpginuse=155842, swpgonly=129083, paging=0
 db>