Still trying to debug mbuf leak.. Anyone familiar with uma_*?

[Jason DiCioccio]

So I've got various vmcores here from kmem_malloc failures..  I already 
know that it's an excess of mbufs that's causing the crash, I'm just 
trying to figure out what the mbufs contain so that I can try and figure 
out where they came from..

Currently I'm able to get at (uma_zone_t)zone_mbuf, but I'm unsure how 
to get to the actual mbuf data from there.  I've tried looking the the 
uma_keg, etc.  No luck so far.  Is there anyone familiar with these data 
structures that could point me in the right direction?

(kgdb) p *zone_mbuf
$66 = {uz_name = 0xc076d6d1 "mbuf", uz_lock = 0xc1048108, uz_keg = 
0xc1048100,
  uz_link = {le_next = 0xc1047180, le_prev = 0xc104812c}, uz_full_bucket = {
    lh_first = 0x0}, uz_free_bucket = {lh_first = 0x0},
  uz_ctor = 0xc05068f0 <mb_ctor_mbuf>, uz_dtor = 0xc0507040 <mb_dtor_mbuf>,
  uz_init = 0, uz_fini = 0, uz_allocs = 137806761, uz_frees = 136018292,
  uz_fails = 136, uz_fills = 4, uz_count = 128, uz_cpu = {{
      uc_freebucket = 0xc73a8c48, uc_allocbucket = 0x0, uc_allocs = 0,
      uc_frees = 0}}}

Thanks!
-JD-