Panic on boot with em1 attached

[Vladimir V. Kobal]

Hello,

System is a NAS and has two interfaces. Default route is on em0. The network
consisting of 2k hosts is attached to the em1. 7.0-RELEASE, 7.1-BETA2,
7.1-RC1
has the same error. In the progress of boot (uptime 7 seconds) it is
panicing:

Slab at 0xffffff000152ef50, freei 2 = 0.
panic: Duplicate free of item 0xffffff000152e200 from zone
0xffffff003bfd3000(mbuf_packet)

If I detach em1 before boot, the system boots and works well, but after
attaching em1 back constantly appears a messages like this:

rtfree: 0xffffff000187f7c0 has 1 refs

May be the cause of this warnings is connected to the cause of panic.

Here is a backtrace:

#0  doadump () at pcpu.h:195
#1  0xffffffff802cbc97 in boot (howto=260) at
../../../kern/kern_shutdown.c:418
#2  0xffffffff802cc13c in panic (fmt=Variable "fmt" is not available.
) at ../../../kern/kern_shutdown.c:574
#3  0xffffffff805029a8 in uma_dbg_free (zone=Variable "zone" is not
available.
) at ../../../vm/uma_dbg.c:302
#4  0xffffffff80501434 in uma_zfree_arg (zone=0xffffff003bfd3000,
item=0xffffff000152e200, udata=0x0) at ../../../vm/uma_core.c:2265
#5  0xffffffff803237d9 in m_freem (mb=0x0) at mbuf.h:515
#6  0xffffffff803d39a1 in ip_fastforward (m=0xffffff000152e200) at
../../../netinet/ip_fastfwd.c:609
#7  0xffffffff8036ace6 in ether_demux (ifp=0xffffff0001257000,
m=0xffffff000152e200) at ../../../net/if_ethersubr.c:770
#8  0xffffffff8036af62 in ether_input (ifp=0xffffff0001257000,
m=0xffffff000152e200) at ../../../net/if_ethersubr.c:692
#9  0xffffffff801fe6f4 in em_rxeof (adapter=0xffffffff80c57000, count=99) at
../../../dev/e1000/if_em.c:4539
#10 0xffffffff801feb8b in em_handle_rxtx (context=Variable "context" is not
available.
) at ../../../dev/e1000/if_em.c:1702
#11 0xffffffff80303481 in taskqueue_run (queue=0xffffff0001258600) at
../../../kern/subr_taskqueue.c:282
#12 0xffffffff8030363a in taskqueue_thread_loop (arg=Variable "arg" is not
available.
) at ../../../kern/subr_taskqueue.c:401
#13 0xffffffff802aa7ff in fork_exit (callout=0xffffffff803035e0
<taskqueue_thread_loop>, arg=0xffffffff80c5b588, frame=0xffffffff9ead9c80)
    at ../../../kern/kern_fork.c:804
#14 0xffffffff805250e3 in fork_trampoline () at
../../../amd64/amd64/exception.S:455

Dump for the mbuf:

0xffffff000152e200:     0x00    0x00    0x00    0x00    0x00    0x00    0x00
0x00
0xffffff000152e208:     0x00    0x00    0x00    0x00    0x00    0x00    0x00
0x00
0xffffff000152e210:     0x10    0x68    0x53    0x01    0x00    0xff    0xff
0xff
0xffffff000152e218:     0x30    0x00    0x00    0x00    0x03    0x00    0x00
0x00
0xffffff000152e220:     0x01    0x00    0xad    0xde    0xde    0xc0    0xad
0xde
0xffffff000152e228:     0x00    0x70    0x25    0x01    0x00    0xff    0xff
0xff
0xffffff000152e230:     0x00    0x00    0x00    0x00    0x00    0x00    0x00
0x00
0xffffff000152e238:     0x30    0x00    0x00    0x00    0x00    0x0f    0x00
0x00
0xffffff000152e240:     0xff    0xff    0x00    0x00    0x00    0x00    0x00
0x00
0xffffff000152e248:     0x00    0x00    0x00    0x00    0x00    0x00    0x00
0x00
0xffffff000152e250:     0x00    0x68    0x53    0x01    0x00    0xff    0xff
0xff
0xffffff000152e258:     0x00    0x00    0x00    0x00    0x00    0x00    0x00
0x00
0xffffff000152e260:     0x00    0x00    0x00    0x00    0x00    0x00    0x00
0x00
0xffffff000152e268:     0x00    0x08    0x00    0x00    0xde    0xc0    0xad
0xde
0xffffff000152e270:     0x3c    0x00    0xfb    0x3b    0x00    0xff    0xff
0xff
0xffffff000152e278:     0x06    0x00    0x00    0x00    0xde    0xc0    0xad
0xde
0xffffff000152e280:     0xde    0xc0    0xad    0xde    0xde    0xc0    0xad
0xde
0xffffff000152e288:     0xde    0xc0    0xad    0xde    0xde    0xc0    0xad
0xde
0xffffff000152e290:     0xde    0xc0    0xad    0xde    0xde    0xc0    0xad
0xde
0xffffff000152e298:     0xde    0xc0    0xad    0xde    0xde    0xc0    0xad
0xde
0xffffff000152e2a0:     0xde    0xc0    0xad    0xde    0xde    0xc0    0xad
0xde
0xffffff000152e2a8:     0xde    0xc0    0xad    0xde    0xde    0xc0    0xad
0xde
0xffffff000152e2b0:     0xde    0xc0    0xad    0xde    0xde    0xc0    0xad
0xde
0xffffff000152e2b8:     0xde    0xc0    0xad    0xde    0xde    0xc0    0xad
0xde
0xffffff000152e2c0:     0xde    0xc0    0xad    0xde    0xde    0xc0    0xad
0xde
0xffffff000152e2c8:     0xde    0xc0    0xad    0xde    0xde    0xc0    0xad
0xde
0xffffff000152e2d0:     0xde    0xc0    0xad    0xde    0xde    0xc0    0xad
0xde
0xffffff000152e2d8:     0xde    0xc0    0xad    0xde    0xde    0xc0    0xad
0xde
0xffffff000152e2e0:     0xde    0xc0    0xad    0xde    0xde    0xc0    0xad
0xde
0xffffff000152e2e8:     0xde    0xc0    0xad    0xde    0xde    0xc0    0xad
0xde
0xffffff000152e2f0:     0xde    0xc0    0xad    0xde    0xde    0xc0    0xad
0xde
0xffffff000152e2f8:     0xde    0xc0    0xad    0xde    0xde    0xc0    0xad
0xde

I have a tcpdump file for the traffic on em1 during the boot but I can't
work out
the method of finding the matching packet to the mbuf.

Is there any idea where the problem lies? 

Best regards,
Vladimir Kobal