pfSense

To replicate, connect to any FTP server in active mode, and try a directory listing. The box will immediately panic with:

Fatal trap 12: page fault while in kernel mode
cpuid = 0; apic id = 00
fault virtual address = 0x58
fault code = supervisor write, page not present
instruction pointer = 0x20:0xc050f303
stack pointer = 0x28:0xe571d7c8
frame pointer = 0x28:0xe571d8c8
code segment = base 0x0, limit 0xfffff, type 0x1b = DPL 0, pres 1, def32 1, gran 1
processor eflags = interrupt enabled, resume, IOPL = 0
current process = 0 (em0 taskq)
[thread pid 0 tid 64029 ]
Stopped at pf_handle_ftp+0xba3: addl $0x1,0x58(%eax)
db> bt
Tracing pid 0 tid 64029 td 0xc32e3480
pf_handle_ftp(e571daa4,c334d500,c3855d50,14,2,...) at pf_handle_ftp+0xba3
pf_test(2,c32a5c00,e571db74,0,0,...) at pf_test+0x93f
pf_check_out(0,e571db74,c32a5c00,2,0,...) at pf_check_out+0x5c
pfil_run_hooks(c0fbcca0,e571dbb4,c32a5c00,2,0,...) at pfil_run_hooks+0x7e
ip_fastforward(c334d500,e,c32da800,c32da800,c338e802,...) at ip_fastforward+0x46e
ether_demux(c32da800,c334d500,3,0,3,...) at ether_demux+0x12d
ether_input(c32da800,c334d500,0,c750f,c32e3480,...) at ether_input+0x33f
em_rxeof(c32e3480,e571dca4,c098425f,c32e3480,e571dca0,...) at em_rxeof+0x4fa
em_handle_rxtx(c32dc000,1,0,c0dc53b4,0,...) at em_handle_rxtx+0x27
taskqueue_run(c3297580,c3297598,c0dc53b4,0,e571dcf4,...) at taskqueue_run+0x162
taskqueue_thread_loop(c32e0564,e571dd38,0,0,0,...) at taskqueue_thread_loop+0xbd
fork_exit(c0985b60,c32e0564,e571dd38) at fork_exit+0x91
fork_trampoline() at fork_trampoline+0x8
--- trap 0, eip = 0, esp = 0xe571dd70, ebp = 0 ---