latest -HEAD panics when switching from X to text console

[Rumko <rumcic@xxxxxxxxx>]

With latest -HEAD switching from X to a text console triggers a panic:
assertion: pmap->pm_stats.resident_count > 0 in pmap_remove_pte (it is
reproducible)

The backtrace:
#0  dumpsys () at ./machine/thread.h:83
#1  0xc02706c9 in boot (howto=256) at /usr/src/sys/kern/kern_shutdown.c:375
#2  0xc027098c in panic (fmt=0xc04c65dd "assertion: %s in %s")
at /usr/src/sys/kern/kern_shutdown.c:800
#3  0xc047d5ea in pmap_remove_pte (pmap=0xc060d660, ptq=0xbff96618,
va=3851968512, info=0xf0e006f0)
    at /usr/src/sys/platform/pc32/i386/pmap.c:1611
#4  0xc047dbd7 in pmap_remove (pmap=0xc060d660, sva=3770052608, eva=4038488064)
at /usr/src/sys/platform/pc32/i386/pmap.c:1752
#5  0xc03c8f0d in vm_map_delete (map=0xc05f0fa0, start=3770052608,
end=4038488064, countp=0xf0e00770)
    at /usr/src/sys/vm/vm_map.c:2564
#6  0xc03c9c19 in vm_map_remove (map=0xc05f0fa0, start=3770052608,
end=4038488064) at /usr/src/sys/vm/vm_map.c:2608
#7  0xc03c715c in kmem_free (map=0xc05f0fa0, addr=3770052608, size=268435456)
at /usr/src/sys/vm/vm_kern.c:243
#8  0xc048af4e in vesa_unmap_buffer (vaddr=0, size=0)
at /usr/src/sys/dev/video/i386/vesa/vesa.c:811
#9  0xc048b095 in vesa_set_mode (adp=0xc05724c0, mode=282)
at /usr/src/sys/dev/video/i386/vesa/vesa.c:1031
#10 0xc045fc63 in set_mode (scp=0xda520668)
at /usr/src/sys/dev/misc/syscons/syscons.c:3288
#11 0xc045fdc9 in exchange_scr (sc=0xc060df60)
at /usr/src/sys/dev/misc/syscons/syscons.c:2345
#12 0xc0460cc7 in finish_vt_rel (scp=<value optimized out>, release=<value
optimized out>)
    at /usr/src/sys/dev/misc/syscons/syscons.c:2251
#13 0xc046378f in scioctl (ap=0xf0e00a88)
at /usr/src/sys/dev/misc/syscons/syscons.c:941
#14 0xc0259119 in dev_dioctl (dev=0xc410fe48, cmd=536901124,
data=0xf0e00c1c "\001", fflag=7, cred=0xc40c7308)
    at /usr/src/sys/kern/kern_device.c:169
#15 0xc02c7583 in spec_ioctl (ap=0x0)
at /usr/src/sys/vfs/specfs/spec_vnops.c:389
#16 0xc02c6fd1 in spec_vnoperate (ap=0xf0e00ae0)
at /usr/src/sys/vfs/specfs/spec_vnops.c:136
#17 0xc03bdfb4 in ufs_vnoperatespec (ap=0xf0e00ae0)
at /usr/src/sys/vfs/ufs/ufs_vnops.c:2462
#18 0xc02c2b4e in vop_ioctl (ops=0xd3a0c150, vp=0xe0a59d68, command=536901124,
data=0xf0e00c1c "\001", fflag=7,
    cred=0xc40c7308) at /usr/src/sys/kern/vfs_vopops.c:372
#19 0xc02c21ab in vn_ioctl (fp=0xda490a40, com=536901124,
data=0xf0e00c1c "\001", ucred=0xc40c7308)
    at /usr/src/sys/kern/vfs_vnops.c:999
#20 0xc028f9ac in mapped_ioctl (fd=3, com=536901124, uspc_data=0x1 <Address 0x1
out of bounds>, map=0x0)
    at /usr/src/sys/sys/file2.h:87
#21 0xc028fa34 in sys_ioctl (uap=0xf0e00cf0)
at /usr/src/sys/kern/sys_generic.c:527
#22 0xc04812bd in syscall2 (frame=0xf0e00d40)
at /usr/src/sys/platform/pc32/i386/trap.c:1348
#23 0xc046e845 in Xint0x80_syscall ()
at /usr/src/sys/platform/pc32/i386/exception.s:872
#24 0x2831bc84 in ?? ()

Memory dump is located at leaf:~rumko/crash/29.04.2008
-- 
Regards,
Rumko