altq kernel panic with recent HEAD

[Kyle Butt <kylebutt@xxxxxxxxx>]

Core and kernel forthcoming to my leaf account.
Happens upon loading pf with altq. Doesn't happen If I comment out
altq. It is repeatable. I can give my pf.conf if that would help.

Here's a backtrace:

(kgdb) bt
#0  dumpsys () at thread.h:83
#1  0xc02b5e54 in boot (howto=260) at /usr/src/sys/kern/kern_shutdown.c:355
#2  0xc02b65cd in panic (fmt=0xc0528e93 "from debugger") at /usr/src/sys/kern/kern_shutdown.c:757
#3  0xc016dbbe in db_panic (addr=-1068705345, have_addr=0, count=-1, modif=0xd6a2d578 "") at /usr/src/sys/ddb/db_command.c:447
#4  0xc016db53 in db_command (last_cmdp=0xc05e7290, cmd_table=0x0, aux_cmd_tablep=0xc0589bb4, aux_cmd_tablep_end=0xc0589bcc)
    at /usr/src/sys/ddb/db_command.c:343
#5  0xc016dc33 in db_command_loop () at /usr/src/sys/ddb/db_command.c:469
#6  0xc01707b8 in db_trap (type=3, code=0) at /usr/src/sys/ddb/db_trap.c:71
#7  0xc04cd5eb in kdb_trap (type=3, code=0, regs=0xd6a2d69c) at /usr/src/sys/i386/i386/db_interface.c:148
#8  0xc04e3db7 in trap (frame=
      {tf_fs = -910163944, tf_es = -1046806512, tf_ds = -694026224, tf_edi = 1, tf_esi = -1068340907, tf_ebp = -693971228, tf_isp = -693971256, tf_ebx = 256, tf_edx = -1072988160, tf_ecx = 32, tf_eax = 18, tf_trapno = 3, tf_err = 0, tf_eip = -1068705345, tf_cs = 8, tf_eflags = 646, tf_esp = -1068184811, tf_ss = -1068265439}) at /usr/src/sys/i386/i386/trap.c:785
#9  0xc04ce80f in calltrap () at /usr/src/sys/i386/i386/exception.s:774
#10 0xc04cd9bf in Debugger (msg=0x12 <Address 0x12 out of bounds>) at cpufunc.h:73
#11 0xc02b65c5 in panic (fmt=0xc0526955 "assertion: %s in %s") at /usr/src/sys/kern/kern_shutdown.c:755
#12 0xc0320389 in altq_enable (ifq=0xd500da84) at /usr/src/sys/net/altq/altq_subr.c:155
#13 0xd6d6fc1a in ?? ()
#14 0xd500da84 in ?? ()
#15 0xc0e5b0a4 in ?? ()
#16 0xc18ffd70 in ?? ()
#17 0xd6a2d858 in ?? ()
#18 0x00004000 in ?? ()
#19 0x00000003 in ?? ()
#20 0x0b726000 in ?? ()
#21 0x00000000 in ?? ()
#22 0xd6a2d7b8 in ?? ()
#23 0xc04499fa in ffs_getpages (ap=0xd6a2daa8) at ufs_readwrite.c:556
#24 0xc02a0752 in dev_dioctl (dev=0xc00b8000, cmd=18, data=0x12 <Address 0x12 out of bounds>, fflag=18, cred=0x12)
    at /usr/src/sys/kern/kern_device.c:173
#25 0xc0310b66 in spec_ioctl (ap=0xc00b8000) at /usr/src/sys/vfs/specfs/spec_vnops.c:375
#26 0xc0310756 in spec_vnoperate (ap=0xc00b8000) at /usr/src/sys/vfs/specfs/spec_vnops.c:125
#27 0xc04512cb in ufs_vnoperatespec (ap=0xc00b8000) at /usr/src/sys/vfs/ufs/ufs_vnops.c:2460
#28 0xc030ba4e in vop_ioctl (ops=0xc00b8000, vp=0x12, command=18, data=0x12 <Address 0x12 out of bounds>, fflag=18, cred=0x12)
    at /usr/src/sys/kern/vfs_vopops.c:372
#29 0xc030b5b6 in vn_ioctl (fp=0xc175ff40, com=536888362, data=0xd6a2dc14 "\v", ucred=0x12) at /usr/src/sys/kern/vfs_vnops.c:967
#30 0xc02d3d19 in mapped_ioctl (fd=3, com=536888362, uspc_data=0xb <Address 0xb out of bounds>, map=0x0) at file2.h:87
#31 0xc02d3867 in sys_ioctl (uap=0xc00b8000) at /usr/src/sys/kern/sys_generic.c:526
#32 0xc04e47f6 in syscall2 (frame=
      {tf_fs = 47, tf_es = 47, tf_ds = 47, tf_edi = -1077937048, tf_esi = 2, tf_ebp = -1077937144, tf_isp = -693969548, tf_ebx = 3, tf_edx = 672542184, tf_ecx = -1077937216, tf_eax = 54, tf_trapno = 12, tf_err = 2, tf_eip = 672140808, tf_cs = 31, tf_eflags = 514, tf_esp = -1077937172, tf_ss = 47}) at /usr/src/sys/i386/i386/trap.c:1390
#33 0xc04ce89a in Xint0x80_syscall () at /usr/src/sys/i386/i386/exception.s:852
#34 0x0000001f in ?? ()
#35 0x0000002f in ?? ()
#36 0x00000000 in ?? ()
#37 0x00000000 in ?? ()
#38 0x00000000 in ?? ()
#39 0x00000000 in ?? ()
#40 0x18c96000 in ?? ()
#41 0xff800000 in ?? ()
#42 0xc9c06d00 in ?? ()
#43 0xd6a2dcfc in ?? ()
#44 0xd6a2dccc in ?? ()
#45 0xc060ccd4 in softclock_pcpu_ary ()
#46 0xc02bd098 in lwkt_switch () at /usr/src/sys/kern/lwkt_thread.c:740
Previous frame inner to this frame (corrupt stack?)




Thanks for looking at it, 

Kyle