> We're running Solaris 10 08/07 on a single UltraSparc IIIi CPU.
> Occasionally when a process is killed the kernel panics. We've
> collected and analyzed the several core files and they all contain the
> same call stack trace when the panic occurred.

> # exec tcsh
> tcterm@trex5:~% cd /var/crash/trex5/
> tcterm@trex5:/var/crash/trex5% ls
> bounds     unix.10    unix.7     unix.8     unix.9     vmcore.10
> vmcore.7   vmcore.8   vmcore.9
> tcterm@trex5:/var/crash/trex5% mdb -k unix.10 vmcore.10
> Loading modules: [ unix krtld genunix specfs dtrace nfs pcisch ip hook
> neti sctp arp usba fcp fctl nca qlc lofs zfs random sppp ptm logimux ]
>> ::status
> debugging crash dump vmcore.10 (64-bit) from trex5
> operating system: 5.10 Generic_127111-03 (sun4u)
> panic message: anon_decref: slot count 0
> dump content: kernel pages only
>> ::cpuinfo -v
>  ID ADDR        FLG NRUN BSPL PRI RNRN KRNRN SWITCH THREAD      PROC
>   0 00001838968  1b    8    0  59   no    no t-0    300021de660
> logservice
>                   |    |
>        RUNNING <--+    +-->  PRI THREAD      PROC
>          READY                60 2a106883cc0 sched
>         EXISTS                60 2a100bbfcc0 sched
>         ENABLE                60 2a100b47cc0 sched
>                               60 2a100107cc0 sched
>                               60 2a10012fcc0 sched
>                               59 30002278d00 nodebooter
>                               49 3000204fc40 init
>                                0 30002279020 pkill

>> 300021de660::findstack
> stack pointer for thread 300021de660: 2a100a4eb41
>   000002a100a4ebf1 anon_decref+0x17c()
>   000002a100a4eca1 anon_free+0x78()<=================!!
>   000002a100a4ed61 segvn_free+0xc4()