> list *(ugen_get_cdesc+0xb1) 0xffffffff802f8f2e is in ugen_get_cdesc (/usr/src-8/sys/dev/usb/ugen.c:1376). 1371 usb_config_descriptor_t *cdesc, *tdesc, cdescr; 1372 int len; 1373 usbd_status err; 1374 1375 if (index == USB_CURRENT_CONFIG_INDEX) { 1376 tdesc = usbd_get_config_descriptor(sc->sc_udev); 1377 len = UGETW(tdesc->wTotalLength); 1378 if (lenp) 1379 *lenp = len; 1380 cdesc = kmem_alloc(len, KM_SLEEP);
> list *(ugenioctl+0x9a4) 0xffffffff802f99d1 is in ugenioctl (/usr/src-8/sys/dev/usb/ugen.c:1668). 1663 *usbd_get_device_descriptor(sc->sc_udev); 1664 break; 1665 case USB_GET_CONFIG_DESC: 1666 cd = (struct usb_config_desc *)addr; 1667 cdesc = ugen_get_cdesc(sc, cd->ucd_config_index, &cdesclen); 1668 if (cdesc == NULL) 1669 return EINVAL; 1670 cd->ucd_desc = *cdesc; 1671 kmem_free(cdesc, cdesclen); 1672 break; Does that help? What about the ohci0: 1 scheduling overruns that preceded the detach that preceded the panic?