Panic: "m_free: freeing an already freed mbuf" (bsd/kern/uipc_mbuf.c:2742)

Question

This is a consolidation thread for people who have experienced the following panic:
panic(cpu 0 caller 0x0039CDE0): "m_free: freeing an already freed mbuf"@/SourceCache/xnu/xnu-1228/bsd/kern/uipc_mbuf.c:2742
Backtrace, Format - Frame : Return Address (4 potential args on stack)
0x44b9b978 : 0x12b0e1 (0x4555b4 0x44b9b9ac 0x133238 0x0)
0x44b9b9c8 : 0x39cde0 (0x48cc84 0x302f7500 0x552aa01c 0x44b9ba08)
0x44b9ba08 : 0x39d0dc (0x302f9400 0x8 0x44b9ba58 0x1)
0x44b9ba28 : 0xa18b87 (0x302f7500 0x0 0x20 0x2)
0x44b9bb98 : 0xa18ec5 (0x23cc32c8 0x23cc5150 0x15561 0x0)
0x44b9bce8 : 0xa2420b (0x23d51004 0x0 0x44b9bd18 0x1a677c)
0x44b9be68 : 0x9f484a (0x23cc34c0 0xfe942808 0x0 0x0)
0x44b9beb8 : 0x9f5f3f (0xa7cc80 0xa7cc84 0x44b9bed8 0x1a136f)
0x44b9bf48 : 0x9f44b7 (0x4415804 0x0 0x5350c0 0x19ccc1)
0x44b9bf78 : 0x13e987 (0x4415c94 0x4415804 0x0 0x429ccc0)
0x44b9bfc8 : 0x19e2ec (0x0 0x0 0x1a10b5 0x47952d4)
Backtrace terminated-invalid frame pointer 0
Kernel loadable modules in backtrace (with dependencies):
com.apple.driver.AirPort.Atheros(300.22)@0x9f3000->0xa7dfff
dependency: com.apple.iokit.IO80211Family(200.7)@0x9d5000
dependency: com.apple.iokit.IOPCIFamily(2.4)@0x647000
dependency: com.apple.iokit.IONetworkingFamily(1.6.0)@0x657000
This panic decodes as:
<pre>0x0012b0dc <panic+417>: call 0x1ad23f <Debugger>
0x0039cddb <m_free+31>: call 0x12af3b <panic>
0x0039d0d7 <m_freem+14>: call 0x39cdbc <m_free>
0x00a18b82 <athtxdraintxq+575>: call 0x382873 <mbuf_freem>
0x00a18ec0 <ath_draintxq+303>: call 0xa18943 <athtxdraintxq>
0x00a24206 <athsetchannel+639>: call 0xa18d91 <ath_draintxq>
0x009f4844 <change_channel+321>: call *0x1808(%esi)
0x009f5f3a <scan_next+939>: call 0x9f4703 <change_channel>
0x009f44b4 <threadcallfunc+127>: call *0x4(%ebx)
0x0013e985 <threadcall_enterdelayed+525>: call *%edi
0x0019e2ea <call_continuation+26>: call *%eax</pre>
So some thread called the scan_next() routine in the Apple.Atheros AirPort driver (Atheros is the brand of Wi-Fi chip in the MacBook and MacBook Pro), which called change_channel() to change the AirPort channel, which told the driver to drain the transmit queue of any outstanding buffers (ath_draintxq().)
Unfortunately, when the driver was done doing that, it tried to free the associated mbuf, which was already free.
Many experiencing this bug have had Azureus, Parallels and/or Little Snitch installed and have found uninstalling one or more of those has resolved their panics.
However the panic traceback above indicates this seems as if it is a general case bug in Leopard and removing the applications named may simply destress the network infrastructure such that the panic no longer occurs. However it is also possible that the kernel extensions associated with the applications above is calling a Leopard analog to a Tiger routine improperly, causing the panic.
Either way, several people have reported the bug via the Apple Bug Reporter at this time.
Please post here if you have concrete evidence of something above (e.g. you had the panic, you removed Little Snitch, the panics are now gone.)
Please don't post rants or simple "me too" posts, but please do post if you are having the panic but have none of the applications mentioned above installed (not running, but installed).
Thanks in advance for your help and patience.

Answer 1

Log of the panic is attached below. I have neither Azureus, Transmission nor Little Snitch. In fact I did a clean install of Leopard because I thought that was causing the problem, I didn't realize everyone else was having the same issue as well. If anyone has a temporary solution to stop the KPs please do share. I'm alright with waiting for the next patch but I'm wondering if all this constant rebooting might kill my hardware before then.
panic(cpu 0 caller 0x0039CD77): "m_free: freeing an already freed mbuf"@/SourceCache/xnu/xnu-1228.0.2/bsd/kern/uipc_mbuf.c:2742
Backtrace, Format - Frame : Return Address (4 potential args on stack)
0x2102f708 : 0x12b0e1 (0x455670 0x2102f73c 0x133238 0x0)
0x2102f758 : 0x39cd77 (0x48e03c 0x1 0x2100901c 0x905180)
0x2102f798 : 0x39d073 (0x1ce94400 0x318b080 0x2102f808 0x294eb8b0)
0x2102f7b8 : 0x8f5821 (0x1ce94400 0x0 0x20 0x0)
0x2102f8e8 : 0x8fe9e5 (0x1 0x0 0x294d4eb0 0x294eb92c)
0x2102fc08 : 0x90393a (0x1292a2c8 0x0 0xbb5a003 0x0)
0x2102fde8 : 0x904fb1 (0x1292a2c8 0x0 0x2102ff08 0x127206)
0x2102ff18 : 0x41d149 (0x1292a000 0x3143280 0x1 0x19ccc1)
0x2102ff68 : 0x41c2a6 (0x3143280 0x0 0x0 0x0)
0x2102ff98 : 0x41bf88 (0x321eec0 0x0 0x2cd8a00 0x0)
0x2102ffc8 : 0x19e2ec (0x321eec0 0x0 0x1a10b5 0x32a0400)
Backtrace terminated-invalid frame pointer 0
Kernel loadable modules in backtrace (with dependencies):
com.apple.driver.AirPort.Atheros(300.22)@0x8d0000->0x95afff
dependency: com.apple.iokit.IO80211Family(200.7)@0x8b2000
dependency: com.apple.iokit.IOPCIFamily(2.4)@0x63c000
dependency: com.apple.iokit.IONetworkingFamily(1.6.0)@0x64c000
BSD process name corresponding to current thread: kernel_task
Mac OS version:
9B18
Kernel version:
Darwin Kernel Version 9.1.0: Wed Oct 31 17:46:22 PDT 2007; root:xnu-1228.0.2~1/RELEASE_I386
System model name: MacBookPro1,2 (Mac-F42DBEC8)