From owner-freebsd-stable@FreeBSD.ORG  Tue Jan 18 22:02:51 2005
Return-Path: <owner-freebsd-stable@FreeBSD.ORG>
Delivered-To: freebsd-stable@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 78A9616A4CE
	for <stable@freebsd.org>; Tue, 18 Jan 2005 22:02:51 +0000 (GMT)
Received: from postal3.es.net (postal3.es.net [198.128.3.207])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 5E63043D45
	for <stable@freebsd.org>; Tue, 18 Jan 2005 22:02:51 +0000 (GMT)
	(envelope-from oberman@es.net)
Received: from ptavv.es.net ([198.128.4.29])
        by postal3.es.net (Postal Node 3) with ESMTP (SSL) id IBA74465
        for <stable@freebsd.org>; Tue, 18 Jan 2005 14:02:51 -0800
Received: from ptavv (localhost [127.0.0.1])
	by ptavv.es.net (Tachyon Server) with ESMTP id 39BB15D08
	for <stable@freebsd.org>; Tue, 18 Jan 2005 14:02:50 -0800 (PST)
To: stable@freebsd.org
Date: Tue, 18 Jan 2005 14:02:50 -0800
From: "Kevin Oberman" <oberman@es.net>
Message-Id: <20050118220250.39BB15D08@ptavv.es.net>
Subject: Fatal trap 12 on 5.3-Stable system
X-BeenThere: freebsd-stable@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Production branch of FreeBSD source code
	<freebsd-stable.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-stable>,
	<mailto:freebsd-stable-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-stable>
List-Post: <mailto:freebsd-stable@freebsd.org>
List-Help: <mailto:freebsd-stable-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-stable>,
	<mailto:freebsd-stable-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Tue, 18 Jan 2005 22:02:51 -0000

On the command:
ping6 -m -s 1460 node
I get a panic with the following (hand transcribed):
Fatal trap 12: page fault while in kernel mode
fault virtual address   = 0x4
fault code              = supervisor read, page not present
inruction pointer       = 0x8:0xc052dc52
stack pointer           = 0x10:0xdb31cc08
frame pointer		= 0x10:-xdb31c44
code segment            = base 0x0, limit 0xfffff, type 0x1b
                        = DPL 0, pres 1, def32 1, gran 1
processor eflags        = interrupt enabled, resume IOPL = 0
current process         = 1043 (ping6)
[thread pid 1043 tid 100095 ]
Stopped at      soreceive+0x556:	movl    0x4(%eax),%eax
db> trace
Tracing pid 1043 tid 100095 td 0xc21a47d0
soreceive(c2151b64,db31cc6c,db31cc78,0,c1c38500) at soreceive+0x556
recvit(c21a47d0,3,db31ccc0,0,c1b3d930) at recvit+0x1c7
recvmsg(c21a47d0,db31cd14,3,1,292) at recvmsg+0x5f
syscall(bfbf002f,2f,bfbf002f,bfbfe82c,8077800,) at syscall+0x27b
Xint0x80_syscall() at Xint0x80_syscall+0x1f
--- syscall (27, FreeBSD ELF32, recvmsg), eip = 0x280fb3d3, esp = 0xbfbfe76c,ebp = 0xbfbfecf4 ---

Looks a lot like the large size might be over-writing something. 
Reproducable at will. 
-- 
R. Kevin Oberman, Network Engineer
Energy Sciences Network (ESnet)
Ernest O. Lawrence Berkeley National Laboratory (Berkeley Lab)
E-mail: oberman@es.net			Phone: +1 510 486-8634