Bug 15136

On attempt to mount MSDOS (FAT16) file system, kernel falls to panic with
message:
panic: vm_fault: fault on nofault entry, addr=c16de000

The effect is constant and appears on both 3.3-STABLE and 4.0-CURRENT.

Debugging says that fault is when fillinusemap() is in cycle with
cn == 51200 in code part (debug print is inserted by me) after first debug
print in following code before second one. Sorry but I cannot debug more
in depth of this problem just now.

==={
                if (!bo || !bp) {
                        printf( "fillinusemap(%d): cn=%d\n", __LINE__, cn );
                        /* Read new FAT block */
                        if (bp)
                                brelse(bp);
                        fatblock(pmp, byteoffset, &bn, &bsize, NULL);
                        error = bread(pmp->pm_devvp, bn, bsize, NOCRED, &bp);
                        if (error) {
                                brelse(bp);
                                return (error);
                        }
                }
===}

The file system is on /dev/wd0s6, C/H/S location 570:0:1 - 773:254:63.
Its super block is:

begin 644 su.D
MZSR0;6MD;W-F<P```D`!``(``@``^,@`/P#_``````",`3(````ITKD8.$DQ
M-40@("`@("`@1D%4,38@("`.'[Y;?*PBP'0+5K0.NP<`S1!>Z_`RY,T6S1GK
M_E1H:7,@:7,@;F]T(&$@8F]O=&%B;&4@9&ES:RX@(%!L96%S92!I;G-E<G0@
M82!B;V]T86)L92!F;&]P<'D@86YD#0IP<F5S<R!A;GD@:V5Y('1O('1R>2!A
M9V%I;B`N+BX@#0H`````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
1````````````````````5:H`
`
end

None of other MSDOS filesystems on this disk cause such effect. Linux (RedHat
6.0), Win98 and MS-DOS all work with all local MSDOS partitions correctly.

Kernel config for 4.0-CURRENT is:

==={
machine		i386
cpu		I586_CPU
cpu		I686_CPU
ident		"nn5"
maxusers	32

makeoptions	DEBUG=-g		#Build kernel with gdb(1) debug symbols

options 	INET			#InterNETworking
options 	FFS			#Berkeley Fast Filesystem
options 	FFS_ROOT		#FFS usable as root device [keep this!]
options 	MFS			#Memory Filesystem
options 	NFS			#Network Filesystem
options 	MSDOSFS			#MSDOS Filesystem
options 	CD9660			#ISO 9660 Filesystem
options 	CD9660_ROOT		#CD-ROM usable as root. "CD9660" req'ed
options 	PROCFS			#Process filesystem
options 	COMPAT_43		#Compatible with BSD 4.3 [KEEP THIS!]
options 	SCSI_DELAY=5000
options 	USERCONFIG		#boot -c editor
options 	VISUAL_USERCONFIG	#visual boot -c editor
options		INCLUDE_CONFIG_FILE
options 	KTRACE			#ktrace(1) syscall trace support
options		DDB
options 	SYSVSHM			#SYSV-style shared memory
options 	SYSVMSG			#SYSV-style message queues
options 	SYSVSEM			#SYSV-style semaphores

controller	isa0
controller	pnp0			# PnP support for ISA
controller	pci0

# Floppy drives
controller	fdc0	at isa? port IO_FD1 irq 6 drq 2
device		fd0	at fdc0 drive 0

# IDE controller and disks
controller	wdc0	at isa? port IO_WD1 irq 14
device		wd0	at wdc0 drive 0
device		wd1	at wdc0 drive 1

# ATAPI devices on wdc?
device		wcd0		#IDE CD-ROM

# atkbdc0 controls both the keyboard and the PS/2 mouse
controller	atkbdc0	at isa? port IO_KBD
device		atkbd0	at atkbdc? irq 1
device		psm0	at atkbdc? irq 12

device		vga0	at isa? port ? conflicts

# splash screen/screen saver
pseudo-device	splash

# syscons is the default console driver, resembling an SCO console
device		sc0	at isa?

# Floating point support - do not disable.
device		npx0	at nexus? port IO_NPX irq 13

# Power management support (see LINT for more options)
device		apm0    at nexus? flags 0x31 # Advanced Power Management

# Serial (COM) ports
device		sio0	at isa? port IO_COM1 flags 0x10 irq 4
device		sio1	at isa? port IO_COM2 irq 3

# Parallel port
device		ppc0	at isa? port? flags 0x40 irq 7
controller	ppbus0		# Parallel port bus (required)
device		lpt0		# Printer
device		plip0		# TCP/IP over parallel
device		ppi0		# Parallel port interface device
#controller	vpo0		# Requires scbus and da0

# Pseudo devices - the number indicates how many units to allocated.
pseudo-device	loop		# Network loopback
pseudo-device	ether		# Ethernet support
pseudo-device	sl	1	# Kernel SLIP
pseudo-device	ppp	1	# Kernel PPP
pseudo-device	tun		# Packet tunnel.
pseudo-device	pty		# Pseudo-ttys (telnet etc)
pseudo-device	gzip		# Exec gzipped a.out's
pseudo-device	vn	2
pseudo-device	disc

# The `bpf' pseudo-device enables the Berkeley Packet Filter.
# Be aware of the administrative consequences of enabling this!
pseudo-device	bpf	2	#Berkeley packet filter

# USB support
controller	uhci0		# UHCI PCI->USB interface
controller	ohci0		# OHCI PCI->USB interface
controller	usb0		# USB Bus (required)
device		ugen0		# Generic
device		uhid0		# "Human Interface Devices"
device		ukbd0		# Keyboard
device		ulpt0		# Printer
device		ums0		# Mouse
options 	INVARIANTS
options 	INVARIANT_SUPPORT
options 	NETATALK		#Appletalk communications protocols
#options 	NS			#Xerox NS protocols
options 	IPFIREWALL		#firewall
options 	IPFIREWALL_VERBOSE
options 	IPFIREWALL_DEFAULT_TO_ACCEPT	#allow everything by default
options		IPPORTACL_V1
options		IPPORTACL_V1_DEBUG=1
options 	TCP_DROP_SYNFIN		#drop TCP packets with SYN+FIN
options 	TCP_RESTRICT_RST	#restrict emission of TCP RST
options 	ICMP_BANDLIM
options 	DUMMYNET
#options 	DEVFS			#devices filesystem
options 	QUOTA			#enable disk quotas
options 	P1003_1B
options 	_KPOSIX_PRIORITY_SCHEDULING
options 	_KPOSIX_VERSION=199309L
pseudo-device	speaker		#Play IBM BASIC-style noises out your speaker
pseudo-device	snp		#Snoop device - to look at pty/vty/etc..
options 	MSGBUF_SIZE=81920
options 	SC_DFLT_FONT		# compile font in
makeoptions	SC_DFLT_FONT=koi8-r
options 	SC_HISTORY_SIZE=600	# number of history buffer lines
options 	SC_MOUSE_CHAR=0x3	# char code for text mode mouse cursor
options 	IDE_DELAY=5000	# Be optimistic about Joe IDE device
===}