Kernel built right after cvs checkout, no custom modifications made.
It is highly reproducible but I have seen acpibat instead of acpitz
at least once, so I think it is somewhat generic issue.
Steps to reproduce:
* boot with urtwn(4) plugged in (dhclient is used)
* login via GDM
* unplug urtwn(4)
ehci_idone: ex=0xffff8000002b0a00 is done!
urtwn0 detached
* plug it again
urtwn0 at uhub3 port 3 "802.11n USB WLAN" rev 2.00/2.00 addr 4
urtwn0: MAC/BB RTL8192CU, RF 6052 2T2R, address 64:66:b3:17:18:5
* initiate power off from Gnome interface
(tap battery icon, tap power button, tap power off)
stopping package daemons: gdm avahi_daemon dbus_daemon
syncing disks... done
panic: Data modified on freelist: word 4 of object 0xffff800000505f80 size 0x58
previous type UVM amap (0xdeadbeee != 0xdeadbeee)
ddb{0}> trace
Debugger() at Debugger+0x5
panic() at panic+0xee
malloc() at malloc+0x62b
_acpi_os_malloc() at _acpi_os_malloc+0x1f
aml_pushscope() at aml_pushscope+0x59
aml_eval() at aml_eval+0xe2
aml_parse() at aml_parse+0x1423
aml_parse() at aml_parse+0x1dc
aml_eval() at aml_eval+0x1c8
aml_evalnode() at aml_evalnode+0x63
aml_evalinteger() at aml_evalinteger+0x4b
acpitz_getreading() at acpitz_getreading+0x24
acpitz_gettempreading() at acpitz_gettempreading+0x21
acpitz_refresh() at acpitz_refresh+0x16
acpitz_notify() at acpitz_notify+0x38
acpi_poll_notify_task() at acpi_poll_notify_task+0x3b
acpi_dotask() at acpi_dotask+0x55
acpi_thread() at acpi_thread+0x11d
end trace frame: 0x0, count: -18
ddb{0}> show registers
ds 0x1825
es 0xd
fs 0x8a0
gs 0xad98
rdi 0x1
rsi 0x269
rbp 0xffff800032c30890
rbx 0xffffffff8178ad98 seltrue_filtops+0x918
rdx 0xa
rcx 0xffffffff819fcd60 cpu_info_primary
rax 0x1
r8 0xffff800032c307b0
r9 0xffff800023063200
r10 0xffff800032c30768
r11 0x8
r12 0x100
r13 0xffff800032c308a0
r14 0x7
r15 0x9
rip 0xffffffff81345e95 Debugger+0x5
cs 0x8
rflags 0x202
rsp 0xffff800032c30890
ss 0x10
ddb{0}> ps
...
PID PPID PGRP UID S FLAGS WAIT COMMAND
* 30595 0 0 0 7 0x40100200 acpi0
...
ddb{1}> trace
Debugger() at Debugger+0x5
x86_ipi_handler() at x86_ipi_handler+0x64
Xresume_lapic_ipi() at Xresume_lapic_ipi+0x1b
--- interrupt ---
Bad frame pointer: 0xffff800032c2bed8
end trace frame: 0xffff800032c2bed8, count: -3
cpu_idle_mwait_cycle+0x52:
ddb{1}> show registers
ds 0xcb88
es 0xbd88
fs 0xbff0
gs 0x1
rdi 0xffff8000001f1800
rsi 0xffff8000004b9040
rbp 0xffff800032c2bdb8
rbx 0x7
rdx 0x1
rcx 0x7
rax 0xffffff7f
r8 0xffffffff81d47258 sched_all_cpus
r9 0x4
r10 0x83b940 acpi_pdirpa_0x82a3e0
r11 0xffffffff813425e0 x86_bus_space_mem_read_4
r12 0
r13 0xffff8000001f1800
r14 0xfffffe811dc3fc08
r15 0
rip 0xffffffff81345e95 Debugger+0x5
cs 0x8
rflags 0x246
rsp 0xffff800032c2bdb8
ss 0x10
ddb{1}> ps
...
PID PPID PGRP UID S FLAGS WAIT COMMAND
* 2950 0 0 0 7 0x40100200 idle1
...
ddb{1}> boot poweroff
ehci0 reset: timeout
ehci0 reset: timeout
(Successful poweoff goes here).
OpenBSD 5.4-current (GENERIC.MP) #0: Tue Jan 7 20:33:54 EET 2014
***@***:/usr/src/sys/arch/amd64/compile/GENERIC.MP
real mem = 4157796352 (3965MB)
avail mem = 4038922240 (3851MB)
mainbus0 at root
bios0 at mainbus0: SMBIOS rev. 2.7 @ 0xeba70 (21 entries)
bios0: vendor American Megatrends Inc. version "X200CA.203" date 07/11/2013
bios0: ASUSTeK COMPUTER INC. X200CA
acpi0 at bios0: rev 2
acpi0: sleep states S0 S3 S4 S5
acpi0: tables DSDT FACP APIC FPDT ECDT MCFG HPET SSDT SSDT SSDT SSDT
acpi0: wakeup devices P0P1(S4) PEG0(S4) PEG1(S4) PEG2(S4) PEG3(S4) XHC1(S3)
EHC1(S3) USB1(S3) USB2(S3) USB3(S3) USB4(S3) EHC2(S3) USB5(S3) USB6(S3)
USB7(S3) HDEF(S4) [...]
acpitimer0 at acpi0: 3579545 Hz, 24 bits
acpimadt0 at acpi0 addr 0xfee00000: PC-AT compat
cpu0 at mainbus0: apid 0 (boot processor)
cpu0: Intel(R) Pentium(R) CPU 2117U @ 1.80GHz, 1796.22 MHz
cpu0:
FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CFLUSH,DS,ACPI,MMX,FXSR,SSE,SSE2,SS,HTT,TM,PBE,SSE3,PCLMUL,DTES64,MWAIT,DS-CPL,VMX,EST,TM2,SSSE3,CX16,xTPR,PDCM,PCID,SSE4.1,SSE4.2,x2APIC,POPCNT,DEADLINE,XSAVE,NXE,LONG,LAHF,PERF,ITSC,FSGSBASE,SMEP,ERMS
cpu0: 256KB 64b/line 8-way L2 cache
cpu0: smt 0, core 0, package 0
mtrr: Pentium Pro MTRR support, 10 var ranges, 88 fixed ranges
cpu0: apic clock running at 99MHz
cpu0: mwait min=64, max=64, C-substates=0.2.1.1.2, IBE
cpu1 at mainbus0: apid 2 (application processor)
cpu1: Intel(R) Pentium(R) CPU 2117U @ 1.80GHz, 1795.92 MHz
cpu1:
FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CFLUSH,DS,ACPI,MMX,FXSR,SSE,SSE2,SS,HTT,TM,PBE,SSE3,PCLMUL,DTES64,MWAIT,DS-CPL,VMX,EST,TM2,SSSE3,CX16,xTPR,PDCM,PCID,SSE4.1,SSE4.2,x2APIC,POPCNT,DEADLINE,XSAVE,NXE,LONG,LAHF,PERF,ITSC,FSGSBASE,SMEP,ERMS
cpu1: 256KB 64b/line 8-way L2 cache
cpu1: smt 0, core 1, package 0
ioapic0 at mainbus0: apid 2 pa 0xfec00000, version 20, 24 pins
acpiec0 at acpi0
acpimcfg0 at acpi0 addr 0xf8000000, bus 0-63
acpihpet0 at acpi0: 14318179 Hz
acpiprt0 at acpi0: bus 0 (PCI0)
acpiprt1 at acpi0: bus -1 (P0P1)
acpiprt2 at acpi0: bus -1 (PEG0)
acpiprt3 at acpi0: bus -1 (PEG1)
acpiprt4 at acpi0: bus -1 (PEG2)
acpiprt5 at acpi0: bus -1 (PEG3)
acpiprt6 at acpi0: bus 1 (RP01)
acpiprt7 at acpi0: bus -1 (RP03)
acpiprt8 at acpi0: bus -1 (RP05)
acpiprt9 at acpi0: bus -1 (RP06)
acpiprt10 at acpi0: bus -1 (RP07)
acpiprt11 at acpi0: bus -1 (RP08)
acpiprt12 at acpi0: bus 2 (RP02)
acpiprt13 at acpi0: bus 3 (RP04)
acpicpu0 at acpi0: C2, C1, PSS
acpicpu1 at acpi0: C2, C1, PSS
acpitz0 at acpi0: critical temperature is 108 degC
acpiac0 at acpi0: AC unit online
acpibat0 at acpi0: BAT0 model "X200-30" serial type LIon oem "ASUSTeK"
acpibtn0 at acpi0: LID_
acpibtn1 at acpi0: SLPB
acpivideo0 at acpi0: GFX0
acpivout0 at acpivideo0: LCDD
cpu0: Enhanced SpeedStep 1796 MHz: speeds: 1800, 1700, 1600, 1500, 1400, 1300,
1200, 1100, 1000, 900, 800 MHz
pci0 at mainbus0 bus 0
pchb0 at pci0 dev 0 function 0 "Intel Core 3G Host" rev 0x09
vga1 at pci0 dev 2 function 0 "Intel HD Graphics 2500" rev 0x09
intagp0 at vga1
agp0 at intagp0: aperture at 0xe0000000, size 0x10000000
inteldrm0 at vga1
drm0 at inteldrm0
inteldrm0: 1366x768
wsdisplay0 at vga1 mux 1: console (std, vt100 emulation)
wsdisplay0: screen 1-5 added (std, vt100 emulation)
"Intel 7 Series xHCI" rev 0x04 at pci0 dev 20 function 0 not configured
"Intel 7 Series MEI" rev 0x04 at pci0 dev 22 function 0 not configured
ehci0 at pci0 dev 26 function 0 "Intel 7 Series USB" rev 0x04: apic 2 int 16
usb0 at ehci0: USB revision 2.0
uhub0 at usb0 "Intel EHCI root hub" rev 2.00/1.00 addr 1
azalia0 at pci0 dev 27 function 0 "Intel 7 Series HD Audio" rev 0x04: msi
azalia0: codecs: Conexant/0x510f, Intel/0x2806, using Conexant/0x510f
audio0 at azalia0
ppb0 at pci0 dev 28 function 0 "Intel 7 Series PCIE" rev 0xc4: msi
pci1 at ppb0 bus 1
ppb1 at pci0 dev 28 function 1 "Intel 7 Series PCIE" rev 0xc4: msi
pci2 at ppb1 bus 2
"Ralink RT3290" rev 0x00 at pci2 dev 0 function 0 not configured
"Ralink Bluetooth" rev 0x00 at pci2 dev 0 function 1 not configured
ppb2 at pci0 dev 28 function 3 "Intel 7 Series PCIE" rev 0xc4: msi
pci3 at ppb2 bus 3
"Attansic Technology AR8172" rev 0x10 at pci3 dev 0 function 0 not configured
ehci1 at pci0 dev 29 function 0 "Intel 7 Series USB" rev 0x04: apic 2 int 23
usb1 at ehci1: USB revision 2.0
uhub1 at usb1 "Intel EHCI root hub" rev 2.00/1.00 addr 1
pcib0 at pci0 dev 31 function 0 "Intel HM70 LPC" rev 0x04
ahci0 at pci0 dev 31 function 2 "Intel 7 Series AHCI" rev 0x04: msi, AHCI 1.3
scsibus0 at ahci0: 32 targets
sd0 at scsibus0 targ 0 lun 0: <ATA, ST500LT012-9WS14, 0001> SCSI3 0/direct
fixed naa.5000c50061e02624
sd0: 476940MB, 512 bytes/sector, 976773168 sectors
ichiic0 at pci0 dev 31 function 3 "Intel 7 Series SMBus" rev 0x04: apic 2 int 18
iic0 at ichiic0
isa0 at pcib0
isadma0 at isa0
pckbc0 at isa0 port 0x60/5
pckbd0 at pckbc0 (kbd slot)
pckbc0: using irq 1 for kbd slot
wskbd0 at pckbd0: console keyboard, using wsdisplay0
pms0 at pckbc0 (aux slot)
pckbc0: using irq 12 for aux slot
wsmouse0 at pms0 mux 0
pms0: Elantech Clickpad, version 4, firmware 0x361f01
pcppi0 at isa0 port 0x61
spkr0 at pcppi0
uhub2 at uhub0 port 1 "Intel Rate Matching Hub" rev 2.00/0.00 addr 2
uhub3 at uhub1 port 1 "Intel Rate Matching Hub" rev 2.00/0.00 addr 2
uhidev0 at uhub3 port 2 configuration 1 interface 0 "Sunplus 2.4GHz 2way RF
Receiver" rev 2.00/a0.51 addr 3
uhidev0: iclass 3/1, 5 report ids
ums0 at uhidev0 reportid 1: 8 buttons, Z dir
wsmouse1 at ums0 mux 0
uhid0 at uhidev0 reportid 2: input=1, output=0, feature=0
uhid1 at uhidev0 reportid 3: input=6, output=0, feature=0
uhid2 at uhidev0 reportid 4: input=1, output=0, feature=0
uhid3 at uhidev0 reportid 5: input=1, output=0, feature=0
urtwn0 at uhub3 port 3 "802.11n USB WLAN" rev 2.00/2.00 addr 4
urtwn0: MAC/BB RTL8192CU, RF 6052 2T2R, address 64:66:b3:17:18:50
uvideo0 at uhub3 port 4 configuration 1 interface 0 "Generic USB2.0 HD UVC
WebCam" rev 2.00/5.30 addr 5
video0 at uvideo0
vscsi0 at root
scsibus1 at vscsi0: 256 targets
softraid0 at root
scsibus2 at softraid0: 256 targets
root on sd0a (1c4a73a8a26b6b6b.a) swap on sd0b dump on sd0b
