while rebooting with one or more processes running under systrace, 
I get kernel panic each time. (reproducible)


Fatal trap 12: page fault while in kernel mode
fault virtual address   = 0x0
fault code              = supervisor write, page not present
instruction pointer     = 0x8:0xc022664a
stack pointer           = 0x10:0xcc02eebc
frame pointer           = 0x10:0xcc02eec8
code segment            = base 0x0, limit 0xfffff, type 0x1b
                        = DPL 0, pres 1, def32 1, gran 1
processor eflags        = interrupt enabled, resume, IOPL = 0
current process         = 1 (init)
interrupt mask          = none
kernel: type 12 trap, code=0
Stopped at      systrace_msg_child+0x9a:        movl    %ebx,0(%eax)
db> t
systrace_msg_child(c1394700,d16baf00,ffffffff,c1394700,2) at
systrace_msg_child+0x9a
systrace_sys_exit(cc0253c0) at systrace_sys_exit+0x39
wait1(cc027e00,cc02ef80,0,cc02efa0,c03825a5) at wait1+0x1ad
wait4(cc027e00,cc02ef80,0,bfbffe10,bfbffe1c) at wait4+0x10
syscall2(2f,2f,2f,bfbffe1c,bfbffe10) at syscall2+0x229
Xint0x80_syscall() at Xint0x80_syscall+0x25
db> 


... occured after I typed reboot 

there was only one process running under systrace:
  systrace -a /usr/libexec/ftpd -DA

db> ps
  pid   proc     addr    uid  ppid  pgrp  flag stat wmesg   wchan   cmd
  143 cc024ee0 d16a4000    0   117   143 004006  2                  reboot
  117 cc025560 d1694000    0   115   117 004086  3    wait cc025560 bash
  115 cc025700 d1686000    0    91   115 2004086  3   pause d1686260 csh
   91 cc026400 d165e000 1000     1    91 004086  2                  sh
   72 cc026dc0 d1600000    0     1    72 000004  2
syslogd
   28 cc026f60 d15fc000    0     1    28 2000084  2
adjkerntz
    7 cc027440 d1112000    0     0     0 000204  2                  syncer
    6 cc0275e0 d110f000    0     0     0 000604  2                  vnlru
    5 cc027780 d110c000    0     0     0 000604  2
bufdaemon
    4 cc027920 d1109000    0     0     0 000204  3  psleep c0474440
vmdaemon
    3 cc027ac0 d1106000    0     0     0 000604  2
pagedaemon
    2 cc027c60 cc9ff000    0     0     0 000204  3   tqthr c047d460
taskqueue
    1 cc027e00 cc02c000    0     0     1 004204  2                  init
    0 c047c720 c052e000    0     0     0 000204  3   sched c047c720
swapper
   81 cc026a80 d1638000    0     1    81 002004  5                  cron
  114 cc0258a0 d167e000    0     1   114 006006  5                  getty
   79 cc026c20 d1605000    0     1    79 002004  5                  inetd
   83 cc0268e0 d163e000    0     1    83 002104  5                  sshd
  106 cc0272a0 d15ec000    0     1   106 006006  5                  getty
  107 cc026260 d166e000    0     1   107 006006  5                  getty
\
  108 cc025f20 d1676000    0     1   108 006006  5                  getty
  109 cc027100 d15f4000    0     1   109 006006  5                  getty
  110 cc0260c0 d1672000    0     1   110 006006  5                  getty
  111 cc025d80 d1666000    0     1   111 006006  5                  getty
  112 cc025be0 d166a000    0     1   112 006006  5                  getty
  113 cc025a40 d167a000    0     1   113 006006  5                  getty
  139 cc025220 d1690000    0     1   139 002004  5 	            systrace
  140 cc0253c0 d168c000    0     1   140 102004  5                  ftpd


panic occured in function systrace_msg_exit(), resp. systrace_msg_child(),
which tried to allocate (kernel allocator) memory from zone,
but alloc function returned only null pointer. insert into queue (TAILQ)
then tried to touch 0x0.


(kgdb) down 2
#11 0xc022664a in systrace_msg_child (fst=0xc1460580, strp=0xd16aaf00,
npid=-1)
    at ../../kern/kern_systrace.c:1851
1851            TAILQ_INSERT_TAIL(&fst->messages, cont, next);
(kgdb) p cont
$1 = (struct str_msgcontainer *) 0x0
(kgdb) 

while invetsigating this further, I came upon weird call of
systrace_sys_exit():
   systrace_sys_exit() was called in kern_exit.c:wait1() and not in exit1() 

After correction, I can not see the panic any longer.