assertion: _tp->tt_msg->tt_cpuid == mycpuid in tcp_callout_active

["Samuel J. Greear" <sjg@xxxxxxxxxxxx>]

(kgdb) bt
#0  _get_mycpu (di=0xc0e044c0) at ./machine/thread.h:83
#1  md_dumpsys (di=0xc0e044c0) at
/home/sjg/dragonfly/sys/platform/pc32/i386/dump_machdep.c:263
#2  0xc03220f9 in dumpsys () at /home/sjg/dragonfly/sys/kern/kern_shutdown.c:839
#3  0xc03226cb in boot (howto=260) at
/home/sjg/dragonfly/sys/kern/kern_shutdown.c:388
#4  0xc0322c2e in panic (fmt=0xc05cf363 "assertion: %s in %s") at
/home/sjg/dragonfly/sys/kern/kern_shutdown.c:745
#5  0xc03f6ddb in tcp_callout_active (tp=0xdae604c8) at
/home/sjg/dragonfly/sys/netinet/tcp_timer2.h:97
#6  tcp_output (tp=0xdae604c8) at
/home/sjg/dragonfly/sys/netinet/tcp_output.c:769
#7  0xc03f5a80 in tcp_input (m=<value optimized out>) at
/home/sjg/dragonfly/sys/netinet/tcp_input.c:2568
#8  0xc03ec6de in transport_processing_oncpu (m=0xdfe41a00, hlen=20,
ip=0x0) at /home/sjg/dragonfly/sys/netinet/ip_input.c:411
#9  0xc03edaac in ip_input (m=0xdfe41a00) at
/home/sjg/dragonfly/sys/netinet/ip_input.c:951
#10 0xc03edae0 in ip_input_handler (msg0=0xdfe41a18) at
/home/sjg/dragonfly/sys/netinet/ip_input.c:434
#11 0xc03ad95d in netisr_run (num=2, m=0xdfe41a00) at
/home/sjg/dragonfly/sys/net/netisr.c:590
#12 0xc03a384d in ether_demux_oncpu (ifp=0xdb0ad0b8, m=0xdfe41a00) at
/home/sjg/dragonfly/sys/net/if_ethersubr.c:1365
#13 0xc03a3990 in ether_input_oncpu (ifp=0xdb0ad0b8, m=0xdfe41a00) at
/home/sjg/dragonfly/sys/net/if_ethersubr.c:1424
#14 0xc03a3a9a in ether_input_handler (nmsg=0xdfe41a18) at
/home/sjg/dragonfly/sys/net/if_ethersubr.c:1532
#15 0xc03ad6bb in netmsg_service (msg=0xdfe41a18, mpsafe_mode=1,
mplocked=0) at /home/sjg/dragonfly/sys/net/netisr.c:303
#16 0xc03f8e31 in tcpmsg_service_loop (dummy=0x0) at
/home/sjg/dragonfly/sys/netinet/tcp_subr.c:410
#17 0xc032cb56 in lwkt_deschedule_self (td=Cannot access memory at address 0x8
) at /home/sjg/dragonfly/sys/kern/lwkt_thread.c:250
Backtrace stopped: previous frame inner to this frame (corrupt stack?)

kern/vmcore.17 is en-route to leaf.

Happened while doing repeated runs of apachebench against test server:
http://pastie.org/1074861

Have not been able to reproduce.