NetBSD current (5.99.60 2012-01-27 01:06:18 UTC)が今日の4時頃に、きれいにcrashしていた。

savecore(8)はこんなメッセージを残し、

reboot after panic: panic: uarea_system_poolpage_free: failed to free uarea 0xffff8000483d8000

スタックトレースはこんな感じ:

(gdb) where
#0  0xffffffff802f8921 in cpu_reboot (howto=260, bootstr=)
    at /usr/src/sys/arch/amd64/amd64/machdep.c:753
#1  0xffffffff8043fb2b in vpanic (
    fmt=0xffffffff8064a5a8 "%s: failed to free uarea %p", 
    ap=0xfffffe8003feca20) at /usr/src/sys/kern/subr_prf.c:308
#2  0xffffffff8043fbf9 in panic (fmt=)
    at /usr/src/sys/kern/subr_prf.c:205
#3  0xffffffff804da2a5 in uarea_system_poolpage_free (pp=, 
    addr=0xffff8000483d8000) at /usr/src/sys/uvm/uvm_glue.c:319
#4  0xffffffff8043c7a7 in pool_allocator_free (v=, 
    pp=0xfffffe80693c5180) at /usr/src/sys/kern/subr_pool.c:2878
#5  pr_pagelist_free (pp=0xfffffe80693c5180, pq=0xfffffe8003fecaf0)
    at /usr/src/sys/kern/subr_pool.c:487
#6  0xffffffff8043da4b in pool_reclaim (pp=0xfffffe80693c5180)
    at /usr/src/sys/kern/subr_pool.c:1698
#7  0xffffffff8043dba3 in pool_drain_end (pp=0xfffffe80693c5180, where=4818)
    at /usr/src/sys/kern/subr_pool.c:1768
#8  0xffffffff804eb950 in uvm_pageout (arg=)
    at /usr/src/sys/uvm/uvm_pdaemon.c:353
#9  0xffffffff80100807 in lwp_trampoline ()
#10 0x0000000000000000 in ?? ()

panic()を呼んでいたのは、

(gdb) up
#1  0xffffffff8043fb2b in vpanic (
    fmt=0xffffffff8064a5a8 "%s: failed to free uarea %p", 
    ap=0xfffffe8003feca20) at /usr/src/sys/kern/subr_prf.c:308
308             cpu_reboot(bootopt, NULL);
(gdb) up
#2  0xffffffff8043fbf9 in panic (fmt=)
    at /usr/src/sys/kern/subr_prf.c:205
205             vpanic(fmt, ap);
(gdb) up
#3  0xffffffff804da2a5 in uarea_system_poolpage_free (pp=, 
    addr=0xffff8000483d8000) at /usr/src/sys/uvm/uvm_glue.c:319
319                     panic("%s: failed to free uarea %p", __func__, addr);
(gdb) l
314
315     static void
316     uarea_system_poolpage_free(struct pool *pp, void *addr)
317     {
318             if (!cpu_uarea_free(addr))
319                     panic("%s: failed to free uarea %p", __func__, addr);
320     }
321
322     static struct pool_allocator uvm_uarea_system_allocator = {
323             .pa_alloc = uarea_system_poolpage_alloc,

といった感じ。