--- a/sys/dev/raid/arcmsr/arcmsr.c +++ b/sys/dev/raid/arcmsr/arcmsr.c @@ -3054,7 +3054,9 @@ || (pccb->ccb_h.flags & CAM_DATA_PHYS) != 0) { pccb->ccb_h.status |= CAM_PROVIDE_FAIL; xpt_done(pccb); - kfree(srb, M_DEVBUF); + /* the srb belongs to the bus_dmamem SRB pool: + * recycle it, never kfree() a pool pointer */ + arcmsr_free_srb(srb); return; } segs=(struct bus_dma_segment *)pccb->csio.data_ptr;