Bug 13180

I've been plagued by this panic for quite a while now on my internet gateway/proxy/firewall machine. It's started on version 2.2.5. Recent upgrade to -STABLE didn't help a bit. System crashes only at day time, when my local users are actively browsing the Net.
I found two old unresolved and closed, but suspiciosly similar PRs: kern/216 and kern/7288. Mine system has the same SCSI adapter as theirs: NCR 53c815.

Dmesg and kgdb output follows.

Copyright (c) 1992-1998 FreeBSD Inc.
Copyright (c) 1982, 1986, 1989, 1991, 1993
        The Regents of the University of California.  All rights reserved.

FreeBSD 2.2.8-STABLE #0: Mon Aug 16 12:32:36 PDT 1999
    root@purgator.metabyte.com:/usr/src/sys/compile/MASTER.DDB
CPU: Pentium/P55C (200.46-MHz 586-class CPU)
  Origin = "GenuineIntel"  Id = 0x543  Stepping=3
  Features=0x8001bf<FPU,VME,DE,PSE,TSC,MSR,MCE,CX8,MMX>
real memory  = 33554432 (32768K bytes)
avail memory = 30789632 (30068K bytes)
Probing for devices on PCI bus 0:
chip0 <Intel 82439TX PCI cache memory controller> rev 1 on pci0:0:0
chip1 <Intel 82371AB PCI-ISA bridge> rev 1 on pci0:7:0
chip2 <Intel 82371AB IDE interface> rev 1 on pci0:7:1
chip3 <Intel 82371AB USB interface> rev 1 int d irq 11 on pci0:7:2
chip4 <Intel 82371AB Power management controller> rev 1 on pci0:7:3
xl0 <3Com 3c900 Etherlink XL 10BaseT> rev 0 int a irq 11 on pci0:9:0
xl0: Ethernet address: 00:60:97:05:47:61
xl0: selecting 10baseT transceiver, half duplex
xl1 <3Com 3c905 Fast Etherlink XL 10/100BaseTX> rev 0 int a irq 5 on pci0:11:0
xl1: Ethernet address: 00:60:08:68:b6:80
xl1: autoneg complete, link status good (half-duplex, 100Mbps)
xl2 <3Com 3c905 Fast Etherlink XL 10/100BaseTX> rev 0 int a irq 9 on pci0:13:0
xl2: Ethernet address: 00:60:08:8d:6c:56
xl2: autoneg complete, link status good (half-duplex, 100Mbps)
ncr0 <ncr 53c810a fast10 scsi> rev 18 int a irq 10 on pci0:15:0
ncr0 waiting for scsi devices to settle
(ncr0:0:0): "QUANTUM FIREBALL1080S 1Q04" type 0 fixed SCSI 2
sd0(ncr0:0:0): Direct-Access 
sd0(ncr0:0:0): 10.0 MB/s (100 ns, offset 8)
1042MB (2134305 512 byte sectors)
(ncr0:1:0): "QUANTUM LIGHTNING 730S 2417" type 0 fixed SCSI 2
sd1(ncr0:1:0): Direct-Access 
sd1(ncr0:1:0): 10.0 MB/s (100 ns, offset 8)
698MB (1431518 512 byte sectors)
(ncr0:6:0): "CHINON CD-ROM CDS-535 Q20" type 5 removable SCSI 2
cd0(ncr0:6:0): CD-ROM 
cd0(ncr0:6:0): asynchronous.
can't get the size
Probing for devices on the ISA bus:
sc0 at 0x60-0x6f irq 1 on motherboard
sc0: VGA color <16 virtual consoles, flags=0x0>
sio0 at 0x3f8-0x3ff irq 4 on isa
sio0: type 16550A
sio1 at 0x2f8-0x2ff irq 3 on isa
sio1: type 16550A
fdc0 at 0x3f0-0x3f7 irq 6 drq 2 on isa
fdc0: FIFO enabled, 8 bytes threshold
fd0: 1.44MB 3.5in
npx0 flags 0x1 on motherboard
npx0: INT 16 interface
Intel Pentium detected, installing workaround for F00F bug
IP packet filtering initialized, divert enabled, unlimited logging
changing root device to sd0s1a
WARNING: / was not properly dismounted.


(kgdb) core-file /var/crash/vmcore.1
IdlePTD 1fb000
current pcb at 1ba2a4
panic: ffs_alloccg: map corrupted
#0  boot (howto=256) at ../../kern/kern_shutdown.c:266
266                                     dumppcb.pcb_cr3 = rcr3();
(kgdb) where
#0  boot (howto=256) at ../../kern/kern_shutdown.c:266
#1  0xf0115033 in panic (fmt=0xf016cca0 "ffs_alloccg: map corrupted")
    at ../../kern/kern_shutdown.c:400
#2  0xf016ce41 in ffs_mapsearch (fs=0xf0c71000, cgp=0xf336f000, bpref=31216, 
    allocsiz=8) at ../../ufs/ffs/ffs_alloc.c:1387
#3  0xf016bd97 in ffs_alloccgblk (fs=0xf0c71000, cgp=0xf336f000, bpref=31216)
    at ../../ufs/ffs/ffs_alloc.c:990
#4  0xf016b801 in ffs_alloccg (ip=0xf0daa800, cg=3, bpref=129520, size=8192)
    at ../../ufs/ffs/ffs_alloc.c:840
#5  0xf016b3de in ffs_hashalloc (ip=0xf0daa800, cg=3, pref=129520, size=8192, 
    allocator=0xf016b738 <ffs_alloccg>) at ../../ufs/ffs/ffs_alloc.c:703
#6  0xf016a92e in ffs_alloc (ip=0xf0daa800, lbn=1135, bpref=129520, size=8192, 
    cred=0xf0d29680, bnp=0xefbffde8) at ../../ufs/ffs/ffs_alloc.c:137
#7  0xf016d86c in ffs_balloc (ip=0xf0daa800, bn=1135, size=112, 
    cred=0xf0d29680, bpp=0xefbffecc, flags=1) at ../../ufs/ffs/ffs_balloc.c:254
#8  0xf0170bed in ffs_write (ap=0xefbffef4)
    at ../../ufs/ufs/ufs_readwrite.c:260
#9  0xf0139393 in vn_write (fp=0xf0e7b800, uio=0xefbfff38, cred=0xf0d29680)
    at vnode_if.h:283
#10 0xf011cdf6 in write (p=0xf0ce5200, uap=0xefbfff94, retval=0xefbfff84)
    at ../../kern/sys_generic.c:263
#11 0xf019672f in syscall (frame={tf_es = 39, tf_ds = 39, tf_edi = 6381568, 
      tf_esi = 42, tf_ebp = -272639028, tf_isp = -272629788, tf_ebx = 1604936, 
      tf_edx = 6381568, tf_ecx = 8192, tf_eax = 4, tf_trapno = 22, tf_err = 7, 
      tf_eip = 537928657, tf_cs = 31, tf_eflags = 518, tf_esp = -272639056, 
      tf_ss = 39}) at ../../i386/i386/trap.c:920
#12 0x201023d1 in ?? ()
#13 0x18f64 in ?? ()
#14 0x36965 in ?? ()
#15 0x1095 in ?? ()
(kgdb)

Fix: 

Not known. Many thanks in advance to anyone who can spend some time investigating this problem.
How-To-Repeat: I don't think it's possible to reproduce exactly my setup and network environment. System crashes at random time about once a day. Vmcore files are avaliable upon request.