pf(4) panic in pf_modulate_sack() on netbsd-5

["Brian A. Seklecki (CFI NOC)" <seklecki%noc.cfi.pgh.pa.us@localhost>]

This panic happened on the same NetBSD 5_Stable system as my panic 
report from 11/11/2009 (*).

I can make arrangements to migrate this pf.conf(5) to a netbsd-5_stable 
system with a disk and a swap partition to get a panic+dump.  It's 
currently running embedded so no swap partition exists and no 
savecore(8) is available:

Recommendations on next steps?

Thanks,

 ~BAS

(*): For uname(1)+dmesg(1), etc.:

  http://mail-index.netbsd.org/netbsd-users/2009/11/11/msg004826.html


db{0}> bt
pf_modulate_sack(c29beb00,14,cbc8abb4,cbc8ac2c,c2ac13c4,cbc8ac3c,8f35c58d,0,c2a7
e780,c2910200) at netbsd:pf_modulate_sack+0x13b
pf_test_state_tcp(cbc8ac48,1,c2931a00,c29beb00,14,cbb7d80e,cbc8abb4,cbc8ac52,cbc
8ac14,c2910200) at netbsd:pf_test_state_tcp+0x9ef
pf_test(1,c2961000,cbc8acc0,0,c2aa0200,0,44,c26bc4a0,1,cbc8ad28) at 
netbsd:pf_test+0xa26
pfil4_wrapper(0,cbc8acc0,c2961000,1,c29beb00,3,1,c044fb25,c29beb00,14) 
at netbsd:pfil4_wrapper+0x3a
pfil_run_hooks(c128df00,cbc8ad28,c2961000,1,c2928c00,0,b8,c03aff04,c1298f80,c2a6
32e0) at netbsd:pfil_run_hooks+0x75
ip_input(c29beb00,0,cbc8ad40,c044eee4,cbc871d8,cbc871ec,cbc8ad80,c03bea1a,0,c03b
e9b1) at netbsd:ip_input+0x4d9
ipintr(0,c03be9b1,8,292,10,0,927c80,c26d5900,0,cbc8ada0) at 
netbsd:ipintr+0x4a
softint_dispatch(cb927c80,4,0,0,0,0,cbc8ad90,cbc8ac18,cbc8ac70,0) at 
netbsd:softint_dispatch+0x82
DDB lost frame for netbsd:Xsoftintr+0x3d, trying 0xcbc8ad88
Xsoftintr() at netbsd:Xsoftintr+0x3d
--- interrupt ---
fatal page fault in supervisor mode
trap type 6 code 0 eip c04782c1 cs 8 eflags 10282 cr2 3c ilevel 8
kernel: supervisor trap page fault, code=0
Faulted in DDB; continuing...


db{0}> c
fatal double fault in supervisor mode
trap type 13 code 80000000 eip c0100e64 cs 8 eflags 10207 cr2 ce68e526 
ilevel 8
kernel: supervisor trap double fault, code=0
Stopped in pid 0.6 (system) at  netbsd:Xsoftintr+0x34:  pushl   0(%eax)
db{0}> c


db{0}> trace
deviter_init(c1285824,6,cbefd3c4,c01c630a,100,c07ddddc,cbefd3c4,c03c0359,100,0) 
at netbsd:deviter_init+0x11b
pmf_system_shutdown(100,0,cbefd3d4,c0100364,0,c07ddddc,cbefd3d4,c047b937,3,c05e7
e44) at netbsd:pmf_system_shutdown+0xdc
doshutdownhooks(3,c05e7e44,cbefd3f4,c01c3dee,100,0,cbefd3f4,c01c5d21,c05e7e44,c0
7ddddc) at netbsd:doshutdownhooks+0x45
cpu_reboot(100,0,cbefd3f4,c01c5d21,c05e7e44,c07ddddc,cbefd4a4,c01c44be,c03cab3b,
0) at netbsd:cpu_reboot+0x1f
db_sync_cmd(c03cab3b,0,0,cbefd418,802,d,cbefd434,c125e800,0,c125e860) at 
netbsd:db_sync_cmd+0x26
db_command(c0760038,0,cbefd4e4,c01c472b,0,cbefd540,0,cbefd4a8,cbefd4e4,0) 
at netbsd:db_command+0xba
db_command_loop(c03cab3b,0,6,c07ef859,c076023f,c078dc7d,1,0,8,cbefd650) 
at netbs
d:db_command_loop+0xde
db_trap(6,0,58,c0477a69,0,33386563,0,8,cb927280,10) at netbsd:db_trap+0xfc
kdb_trap(6,0,cbefd650,c047e333,c02b80c3,3,6,1,0,cbefd6c8) at 
netbsd:kdb_trap+0x1
49
trap() at netbsd:trap+0x29e
--- trap (number 6) ---
deviter_init(c1285824,6,cbefd6e8,c01c630a,100,c07ddddc,cbefd6e8,c03c0359,100,0) 
a
t netbsd:deviter_init+0x11b
pmf_system_shutdown(100,0,cbefd6f8,c0100364,0,c07ddddc,cbefd6f8,c047b937,3,c05e7
e44) at netbsd:pmf_system_shutdown+0xdc
doshutdownhooks(3,c05e7e44,cbefd718,c01c3dee,100,0,0,0,1000008,c07ddde0) 
at netb
sd:doshutdownhooks+0x45
cpu_reboot(100,0,0,0,1000008,c07ddde0,cbefd7c8,c01c44be,c125e860,0) at 
netbsd:cp
u_reboot+0x1f
db_sync_cmd(c125e860,0,c01c6085,cbefd73c,802,d,63,c125e863,c125e863,c125e860) 
at
 netbsd:db_sync_cmd+0x26
db_command(c0760038,0,cbefd808,c01c472b,0,cbefd864,0,cbefd7cc,cbefd808,0) 
at net
bsd:db_command+0xba
db_command_loop(c03fef87,0,6,c07ef859,c076023f,c078dc7d,1,0,0,cbefd974) 
at netbs
d:db_command_loop+0xde
db_trap(6,0,58,c0477a69,0,61663563,0,0,cb927280,10) at netbsd:db_trap+0xfc
kdb_trap(6,0,cbefd974,c047e333,c040e92a,0,6,0,ccc815c0,ccc815c0) at 
netbsd:kdb_t
rap+0x149
trap() at netbsd:trap+0x29e
--- trap (number 6) ---
incore(ccc81c38,14c0,0,cbefda1c,4e10000,0,c28f3800,ccc81c38,0,cbefda2c) 
at netbs
d:incore+0x33
getblk(ccc81c38,14c0,0,1000,0,0,cbefda4c,0,38,0) at netbsd:getblk+0x32
bio_doread(1000,ffffffff,0,c05c84d5,1,0,cbefdadc,c28f3800,38,0) at 
netbsd:bio_do
read+0x1d
bread(ccc81c38,14c0,0,1000,ffffffff,1,cbefdac8,0,0,0) at netbsd:bread+0x21
ffs_update(ccc815c0,0,0,4,0,0,ccc815e8,0,4,0) at netbsd:ffs_update+0x1db
ffs_full_fsync(ccc815c0,10,1,1,0,3f8,cbefdb6c,c0407263,ccc81660,1) at 
netbsd:ffs
_full_fsync+0x3db
ffs_fsync(cbefdbd8,12,cbefdbec,c040f616,ccc815c0,c060e300,ccc815c0,cb926f00,10,0
) at netbsd:ffs_fsync+0x43
VOP_FSYNC(ccc815c0,cb926f00,10,0,0,0,0,ccc81660,cb924e80,2) at 
netbsd:VOP_FSYNC+
0x79
ffs_sync(ccc26000,2,cb926f00,cb927280,ccc26000,5000,cbefdcbc,c040da79,ccc26000,2
) at netbsd:ffs_sync+0x15b
VFS_SYNC(ccc26000,2,cb926f00,5000,cb924d80,2,0,0,c0100d1f,0) at 
netbsd:VFS_SYNC+
0x1c
sys_sync(cb927280,0,0,8,3,100,cbefdcec,c047bac8,3,c05e7e44) at 
netbsd:sys_sync+0
xc9
vfs_shutdown(3,c05e7e44,cbefdd0c,c01c3dee,100,0,0,0,1000008,c07ddde0) at 
netbsd:
vfs_shutdown+0x47
cpu_reboot(100,0,0,0,1000008,c07ddde0,cbefddbc,c01c44be,c125e860,0) at 
netbsd:cp
u_reboot+0x1b0
db_sync_cmd(c125e860,0,c01c6085,cbefdd30,802,d,63,c125e863,c125e863,c125e860) 
at
 netbsd:db_sync_cmd+0x26
db_command(c0760038,0,cbefddfc,c01c472b,0,cbefde58,0,cbefddc0,cbefddfc,0) 
at net
bsd:db_command+0xba
db_command_loop(c0100e64,0,6,c07ef859,802,1,cbefde2c,ffffff,8,cbefdf84) 
at netbs
d:db_command_loop+0xde
db_trap(d,0,58,ffffffff,8,38366563,80000000,8,cb927280,10) at 
netbsd:db_trap+0xf
c
kdb_trap(d,0,cbefdf84,0,0,0,d,0,0,0) at netbsd:kdb_trap+0x149
trap() at netbsd:trap+0x29e
--- trap (number 13) ---
DDB lost frame for netbsd:Xsoftintr+0x34, trying 0xcbefdf64
Xsoftintr() at netbsd:Xsoftintr+0x34
--- interrupt ---
fatal page fault in supervisor mode
trap type 6 code 0 eip c04782c1 cs 8 eflags 10282 cr2 38 ilevel 8
kernel: supervisor trap page fault, code=0
Faulted in DDB; continuing...