kernel panic w/ cat /dev/sndstat after switching snd_ modules

[Joe Talbott <josepht@xxxxxxxxxx>]

I got a kernel panic when running:

$ cat /dev/sndstat

after unloading snd_via8233.ko and loading snd_via82c686.ko.  I know I
should probably not have done this but I don't think it should crash
the system though.  I have a core dump I can make available if need be.

$ dmesg
. ..
pcm0: detached
pcm0: <VIA VT8233X> port 0xdc00-0xdcff irq 10 at device 17.5 on pci0
pcm0: <Avance Logic ALC655 AC97 Codec>
. ..


$ uname -a
DragonFly [hostname] 1.1-Stable DragonFly 1.1-Stable #13: Wed Apr
6 18:30:25 EDT 2005     root@[hostname]:/usr/obj/usr/src/sys/SOL
i386

panic: page fault
panic messages:
---
Fatal trap 12: page fault while in kernel mode
fault virtual address   = 0xddc0f3c7
fault code              = supervisor read, page not present
instruction pointer     = 0x8:0xc02cdcac
stack pointer           = 0x10:0xdee0585c
frame pointer           = 0x10:0xdee0585c
code segment            = base 0x0, limit 0xfffff, type 0x1b
                        = DPL 0, pres 1, def32 1, gran 1
processor eflags        = interrupt enabled, resume, IOPL = 0
current process         = 71429 (cat)
current thread          = pri 6 
interrupt mask          = tty 
trap number             = 12
panic: page fault


(kgdb) bt
#0  dumpsys () at /usr/src/sys/kern/kern_shutdown.c:508
#1  0xc01ac5b7 in boot (howto=256) at
/usr/src/sys/kern/kern_shutdown.c:341
#2  0xc01ac9e8 in panic (fmt=0xc038528a "%s")
    at /usr/src/sys/kern/kern_shutdown.c:620
#3  0xc030dbb1 in trap_fatal (frame=0xdee0581c, eva=3720410055)
    at /usr/src/sys/i386/i386/trap.c:1144
#4  0xc030d7b9 in trap_pfault (frame=0xdee0581c, usermode=0,
eva=3720410055)
    at /usr/src/sys/i386/i386/trap.c:1033
#5  0xc030d440 in trap (frame=
      {tf_fs = 24, tf_es = 16, tf_ds = 16, tf_edi = 0, tf_esi =
-574557241, tf_ebp = -555722660, tf_isp = -555722680, tf_ebx =
-555722476, tf_edx = -574557241, tf_ecx = 0, tf_eax = -574557241,
tf_trapno = 12, tf_err = 0, tf_eip = -107080174
8, tf_cs = 8, tf_eflags = 66118, tf_esp = -555722512, tf_ss =
-1071907319})
    at /usr/src/sys/i386/i386/trap.c:613
#6  0xc02fcf4b in calltrap ()
#7  0x00000018 in ?? ()
#8  0x00000010 in ?? ()
#9  0x00000010 in ?? ()
#10 0x00000000 in ?? ()
#11 0xddc0f3c7 in ?? ()
#12 0xdee0585c in ?? ()
#13 0xdee05848 in ?? ()
#14 0xdee05914 in ?? ()
#15 0xddc0f3c7 in ?? ()
#16 0x00000000 in ?? ()
#17 0xddc0f3c7 in ?? ()
#18 0x0000000c in ?? ()
#19 0x00000000 in ?? ()
can not access 0xddc0f3c7, invalid address (ddc0f3c7)
can not access 0xddc0f3c7, invalid address (ddc0f3c7)
can not access 0xddc0f3c7, invalid address (ddc0f3c7)
can not access 0xddc0f3c7, invalid address (ddc0f3c7)
can not access 0xddc0f3c7, invalid address (ddc0f3c7)
can not access 0xddc0f3c7, invalid address (ddc0f3c7)
#20 0xc02cdcac in strlen (str=0xddc0f3c7 <Address 0xddc0f3c7 out of
bounds>)
    at /usr/src/sys/libkern/strlen.c:44
#21 0xc01bfe09 in kvprintf (fmt=0xc0370e72 ">", 
    func=0xc01bf7ec <snprintf_func>, arg=0xdee05914, radix=10, 
    ap=0xdee05968 "8°dÌD<?Àj\0167À") at
/usr/src/sys/kern/subr_prf.c:676
#22 0xc01bf7d0 in vsnprintf (str=0xddc0d038 " <", size=4040, 
    format=0xc0370e6e " <%s>", ap=0xdee05964
"ÇóÀÝ8°dÌD<?Àj\0167À")
    at /usr/src/sys/kern/subr_prf.c:418
#23 0xc01c14ee in sbuf_vprintf (s=0xc03f3c44, fmt=0xc0370e6e " <%s>", 
    ap=0xdee05964 "ÇóÀÝ8°dÌD<?Àj\0167À") at
/usr/src/sys/kern/subr_sbuf.c:414
#24 0xc01c1582 in sbuf_printf (s=0xc03f3c44, fmt=0xc0370e6e " <%s>")
    at /usr/src/sys/kern/subr_sbuf.c:450
#25 0xc02cb70b in sndstat_prepare (s=0xc03f3c44)
    at /usr/src/sys/dev/sound/pcm/sndstat.c:302
#26 0xc02cb34c in sndstat_open (i_dev=0xc03d571c, flags=1, mode=8192, 
    td=0xcee4df00) at /usr/src/sys/dev/sound/pcm/sndstat.c:127
#27 0xc019ca99 in cdevsw_putport (port=<incomplete type>,
lmsg=0xdee059e0)
    at /usr/src/sys/kern/kern_device.c:108
#28 0xc01b2621 in lwkt_domsg (port=0xc03d6800, msg=0xdee059e0)
    at /usr/src/sys/sys/msgport2.h:86
#29 0xc019cb98 in dev_dopen (dev=0xc03d571c, oflags=1, devtype=8192, 
    td=0xcee4df00) at /usr/src/sys/kern/kern_device.c:179
#30 0xc01f3aff in spec_open (ap=0xdee05a94)
    at /usr/src/sys/vfs/specfs/spec_vnops.c:242
#31 0xc01f3976 in spec_vnoperate (ap=0xdee05a94)
    at /usr/src/sys/vfs/specfs/spec_vnops.c:123
#32 0xc0294cc2 in ufs_vnoperatespec (ap=0xdee05a94)
    at /usr/src/sys/vfs/ufs/ufs_vnops.c:2379
#33 0xc01ef0d0 in vop_open (ops=<incomplete type>, vp=0xe0a37f18,
mode=1, 
    cred=0xc28a06d8, fp=0xc2841940, td=0xcee4df00)
    at /usr/src/sys/kern/vfs_vopops.c:407
#34 0xc01ee2e3 in vn_open (nd=0xdee05bd8, fp=0xc2841940, fmode=1,
cmode=2176)
    at /usr/src/sys/kern/vfs_vnops.c:299
#35 0xc01eac95 in kern_open (nd=0xdee05bd8, oflags=0,
mode=-1077937520, 
    res=0xdee05c60) at /usr/src/sys/kern/vfs_syscalls.c:1292
#36 0xc01eaf16 in open (uap=0xdee05c34)
    at /usr/src/sys/kern/vfs_syscalls.c:1419
#37 0xc030deca in syscall2 (frame=
      {tf_fs = 47, tf_es = 47, tf_ds = 47, tf_edi = 134567917, tf_esi
= -1077937131, tf_ebp = -1077937520, tf_isp = -555721356, tf_ebx =
-1077937384, tf_edx = -1077937132, tf_ecx = 1, tf_eax = 5, tf_trapno =
12, tf_err = 2, tf_eip = 134516796, tf_cs = 31, tf_eflags = 663,
tf_esp = -1077937580, tf_ss = 47})
    at /usr/src/sys/i386/i386/trap.c:1350
#38 0xc02fcfda in Xint0x80_syscall ()
#39 0x0000002f in ?? ()
#40 0x0000002f in ?? ()
#41 0x0000002f in ?? ()
#42 0x080557ed in ?? ()
#43 0xbfbffc15 in ?? ()
#44 0xbfbffa90 in ?? ()
#45 0xdee05d74 in ?? ()
#46 0xbfbffb18 in ?? ()
#47 0xbfbffc14 in ?? ()
#48 0x00000001 in ?? ()
#49 0x00000005 in ?? ()
#50 0x0000000c in ?? ()
#51 0x00000002 in ?? ()
#52 0x0804903c in ?? ()
#53 0x0000001f in ?? ()
#54 0x00000297 in ?? ()
#55 0xbfbffa54 in ?? ()
#56 0x0000002f in ?? ()
#57 0x00000000 in ?? ()
#58 0x00000000 in ?? ()
#59 0x00000000 in ?? ()
#60 0x00000000 in ?? ()
#61 0x16caf000 in ?? ()
#62 0xff800000 in ?? ()
#63 0xc03d4158 in ithread_ary ()
#64 0xdee055fc in ?? ()
#65 0xdee055ec in ?? ()
#66 0xcee4df00 in ?? ()
#67 0xc01b1522 in lwkt_preempt (ntd=---Can't read userspace from dump,
or kernel process---

) at /usr/src/sys/kern/lwkt_thread.c:763
Previous frame inner to this frame (corrupt stack?)