=== DF-0624 live reproduction panic (CLAIM_PCOUNT=65535, BODY=200) === === guest uname (before panic): === 1. Boot DragonFly [kernel] ,--, ,--, === boot.log relevant excerpt === 202:login: netsmb_dev: loaded 203:bug: ecnt = 16705, but data is NULL (please report) 204:md_get_mem(474): incomplete copy 205:md_get_mem(474): incomplete copy 206:md_get_mem(474): incomplete copy 207:md_get_mem(474): incomplete copy 208:md_get_mem(474): incomplete copy 209:md_get_mem(474): incomplete copy 210:md_get_mem(474): incomplete copy 211:md_get_mem(474): incomplete copy 212:md_get_mem(474): incomplete copy 213:md_get_mem(474): incomplete copy 214:md_get_mem(474): incomplete copy 215:bug: ecnt = 16705, but data is NULL (please report) 216:md_get_mem(474): incomplete copy 217:md_get_mem(474): incomplete copy 218:md_get_mem(474): incomplete copy 219:md_get_mem(474): incomplete copy 220:md_get_mem(474): incomplete copy 221:md_get_mem(474): incomplete copy 222:md_get_mem(474): incomplete copy 223:md_get_mem(474): incomplete copy 224:md_get_mem(474): incomplete copy 225:md_get_mem(474): incomplete copy 226:md_get_mem(474): incomplete copy 227:panic: overflowed mbuf 0xfffff801175c3c00 228:cpuid = 1 229:Trace beginning at frame 0xfffff8011799b5e8 230:m_free() at m_free+0x351 0xffffffff806bdff1 231:m_free() at m_free+0x351 0xffffffff806bdff1 232:m_freem() at m_freem+0x15 0xffffffff806be265 233:md_done() at md_done+0x1c 0xffffffff827b57bc 234:smb_t2_done() at smb_t2_done+0x2a 0xffffffff826163ea 235:smbfs_findclose() at smbfs_findclose+0x86 0xffffffff82620ec6 236:Debugger("panic") 240:Stopped at Debugger+0x7c: movb $0,0xbdaf09(%rip) 241:db>