Method returns package results in interpreter panic - is anyone seeing this on FreeBSD ?

[Dana H. Myers]

I'm seeing a kernel panic in the ACPI CA interpreter under Solaris,
but I don't believe it is Solaris-specific.

The panic reliably happens when evaluating a method which returns
a package which contains a named object as an element.
method.  Here's the panic stack trace, with excess
stuff trimmed:

ffffff00025c2e90 unix:die+f4 ()
ffffff00025c2fc0 unix:trap+38e ()
ffffff00025c2fd0 unix:cmntrap+1d0 ()
ffffff00025c30e0 acpica:AcpiNsGetParentNode+2b ()
ffffff00025c3110 acpica:AcpiNsGetPathnameLength+38 ()
ffffff00025c3160 acpica:AcpiUtGetSimpleObjectSize+8f ()
ffffff00025c31b0 acpica:AcpiUtGetElementLength+32 ()
ffffff00025c3230 acpica:AcpiUtWalkPackageTree+aa ()
ffffff00025c3290 acpica:AcpiUtGetPackageObjectSize+6d ()
ffffff00025c32d0 acpica:AcpiUtGetObjectSize+3d ()
ffffff00025c3350 acpica:AcpiEvaluateObject+1d4 ()
ffffff00025c33c0 acpica:AcpiEvaluateObjectTyped+72 ()

AcpiNsGetParentNode() panics when it attempts to
follow a namespace node peer link.  The node, however,
is uninitialized.

The case which causes this is reproduced reliably by this
simplified test case:

    Method(DANA, 0, NotSerialized)
    {
    Name (DOM1, 0x02)

    Return(Package() {
        Package() {
        0x00,
        0x01,
        DOM1,
        0x03,
        0x04
        }
    } )
    }

Simply evaluating DANA causes the panic when AcpiUtGetElementLength()
tries to handle DOM1 - it's apparently a "local reference" and the
namespace node is apparently uninitialized.  So AcpiNsGetParentNode()
panics trying to find the parent when it attempts to access memory
at 0xCACACACACACACACA.

If I replace DOM1 in the package with 0x02, the panic goes away.

Has anyone encountered this on FreeBSD?

Thanks -
Dana