The following reply was made to PR kern/35071; it has been noted by GNATS.

From: Manuel Bouyer <bouyer@antioche.eu.org>
To: gnats-bugs@NetBSD.org
Cc: kern-bug-people@NetBSD.org, gnats-admin@NetBSD.org,
	netbsd-bugs@NetBSD.org, tjd-nb-pr@menelos.com
Subject: Re: kern/35071: panic: mpt_get_request: corrupted request free list (xfer)
Date: Sat, 18 Nov 2006 15:39:10 +0100

 On Sat, Nov 18, 2006 at 10:55:02AM +0000, Tracy Di Marco White wrote:
 > The following reply was made to PR kern/35071; it has been noted by GNATS.
 > 
 > From: Tracy Di Marco White <tjd-nb-pr@menelos.com>
 > To: gnats-bugs@NetBSD.org
 > Cc: 
 > Subject: Re: kern/35071: panic: mpt_get_request: corrupted request free list (xfer) 
 > Date: Sat, 18 Nov 2006 04:51:40 -0600
 > 
 >  I meant to include the console message prior to the panic, and show
 >  uvm after.
 >  mpt3: mpt_done: no scsipi_xfer, index = 0xfd, seq = 0x00000000
 >  mpt3: request state: Free
 
 I've seen something similar on a netbsd-3 host. I think the problem started
 with:
 sd1(mpt0:0:1:0): command timeout
 mpt0: timeout on request index = 0xfb, seq = 0x0361bdae
 mpt0: Status 0x00000000, Mask 0x00000001, Doorbell 0x24000000
 mpt0: request state: On Chip
 
 So maybe it's the timeout handling code which corrupts the list.
 But I didn't look at the code at all.
 
 -- 
 Manuel Bouyer <bouyer@antioche.eu.org>
      NetBSD: 26 ans d'experience feront toujours la difference
 --