panic: assertion: pmap->pm_stats.resident_count > 0 in pmap_release_free_page

[YONETANI Tomokazu <qhwt+dfly@xxxxxxxxxx>]

Hello.
I've been seeing this panic since the beginning of this month; it's not
the panic on vkernel itself, but the DragonFly kernel running the vkernel
executable.  Basically what I have to do to reproduce the panic is to run
buildworld on vkernel (sometimes buildkernel is enough, sometimes not).
I used -n16 on vkernel's command line argument, but probably I could trigger
the panic with a smaller number.
The first version which triggered the panic was 376534279, one version
earlier than the pmap_map() syntaxis change.  The backtrace below was
from the kernel built from the source tree as of a307f7025.

#4  0xc01a14f8 in panic (fmt=0xc03031fe "assertion: %s in %s")
    at /usr/src/sys/kern/kern_shutdown.c:743
#5  0xc02d9bee in pmap_release_free_page (pmap=0x0, p=0xc1944010)
    at /usr/src/sys/platform/pc32/i386/pmap.c:1157
#6  0xc02d9e26 in pmap_release (pmap=0xd6ea7c14)
    at /usr/src/sys/platform/pc32/i386/pmap.c:1356
#7  0xc029c650 in vmspace_terminate (vm=0xd6ea7b90)
    at /usr/src/sys/vm/vm_map.c:313
#8  0xc017ee80 in _sysref_put (sr=0xd6ea7c88)
    at /usr/src/sys/kern/kern_sysref.c:318
#9  0xc02a5f1e in sysref_put (ve=0xc3223000, vkp=<value optimized out>)
    at /usr/src/sys/sys/sysref2.h:85
#10 vmspace_entry_delete (ve=0xc3223000, vkp=<value optimized out>)
    at /usr/src/sys/vm/vm_vmspace.c:518
#11 0xc02a6396 in sys_vmspace_destroy (uap=0xde8fccf0)
    at /usr/src/sys/vm/vm_vmspace.c:147
#12 0xc02dccfc in syscall2 (frame=0xde8fcd40)
    at /usr/src/sys/platform/pc32/i386/trap.c:1359
#13 0xc02c83f6 in Xint0x80_syscall ()
    at /usr/src/sys/platform/pc32/i386/exception.s:876

The kernel and vmcore files are in my leaf account,
at ~y0netan1/crash/{kern,vmcore}.18.

Best Regards,
YONETANI Tomokazu