OpenBSD/sgi on octane2 - releasing not locked lock

__cpu_simple_lock_tryのバグを直したら、今度はこんなんでましたけど。

Command Monitor.  Type "exit" to return to the menu.
>> bootp()192.168.3.1:bsd
Setting $netaddr to 192.168.3.2 (from server )
Obtaining bsd from server
5889472+492712 entry: 0xa800000020020000
ARCS64 Firmware Version 64.0
Found SGI-IP30, setting up.
Initial setup done, switching console.
cpu_id:0
Copyright (c) 1982, 1986, 1989, 1991, 1993
        The Regents of the University of California.  All rights reserved.
Copyright (c) 1995-2009 OpenBSD. All rights reserved.  http://www.OpenBSD.org

OpenBSD 4.5-current (OCTANE_RAMDISK) #5: Fri May  8 15:16:31 JST 2009

real mem = 1073741824 (1024MB)
rsvd mem = 1064960 (1MB)
avail mem = 1013780480 (966MB)
mainbus0 at root
cpu0 at mainbus0: MIPS R12000 CPU rev 3.5 400 MHz with R10000 FPU rev 0.0
cpu0: cache L1-I 32KB D 32KB 2 way, L2 2048KB 2 way
clock0 at mainbus0: ticker on int5 using count register
xbow0 at mainbus0: XBow revision 5
xheart0 at xbow0 widget 8: Heart revision 6
onewire0 at xheart0
owserial0 at onewire0 family 0x0b sn 0000004d74fa
owserial0: "PM20400MHZ" p/n 030-1476-001, serial KWL381
"Odyssey" revision 2 at xbow0 widget 11 not configured
xbridge0 at xbow0 widget 15: Bridge revision 4
pci0 at xbridge0 bus 0
isp0 at pci0 dev 0 function 0 "QLogic ISP1020" rev 0x05: irq 0
isp0: invalid NVRAM header
scsibus0 at isp0: 16 targets, initiator 7
sd0 at scsibus0 targ 1 lun 0: <QUANTUM, ATLAS_V__9_SCA, 0238> SCSI3 0/direct fixed
sd0: 8682MB, 512 bytes/sec, 17781964 sec total
isp1 at pci0 dev 1 function 0 "QLogic ISP1020" rev 0x05: irq 1
isp1: invalid NVRAM header
scsibus1 at isp1: 16 targets, initiator 7
ioc0 at pci0 dev 2 function 0 "SGI IOC3" rev 0x01
onewire1 at ioc0
owmac0 at onewire1 family 0x09 sn 000002d29696
owmac0: Ethernet Address 08:00:69:13:67:82
owserial1 at onewire1 family 0x0b sn 0000004d4ee4
owserial1: "FP1" p/n 030-0891-003, serial LMR447
owserial2 at onewire1 family 0x0b sn 0000004e12fb
owserial2: "PWR.SPPLY.ER" p/n 060-0035-002, serial AAE0420107
ioc0: superio irq 4, ethernet irq 2
com0 at ioc0 base 0x00020178: ns16550a, 16 byte fifo
com0: console
com1 at ioc0 base 0x00020170: ns16550a, 16 byte fifo
"SGI Rad1" rev 0xc0 at pci0 dev 3 function 0 not configured
rd0: fixed, 8192 blocks
boot device: sd0
root on rd0a swap on rd0b dump on rd0b
WARNING: No TOD clock, believing file system.
WARNING: CHECK AND RESET THE DATE!
__mp_unlock(0x20609d80): releasing not locked lock
Stopped at      0xa800000020164e5c:     jr      ra
0xa800000020164e60:      nop
ddb{0}> trace
0xa800000020164e58 (0,0,5,d) sp ffffffffcffa3ce8 ra a800000020055a88, sz 0
0xa800000020055a50 (0,0,5,d) sp ffffffffcffa3ce8 ra 0, sz 0
User-level: pid 1
ddb{0}>

breakしてるのは、__mp_unlock()のデバッグコード（#ifdef MP_LOCKDEBUGの所）。

static __inline void
__mp_unlock(struct __mp_lock *lock)
{
	int s = spllock();

#ifdef MP_LOCKDEBUG
	if (lock->mpl_count == 0 || lock->mpl_cpu == LK_NOCPU) {
		db_printf("__mp_unlock(0x%x): releasing not locked lock\n",
		    lock);
		Debugger();
	}
#endif

	if (--lock->mpl_count == 0) {
		lock->mpl_cpu = LK_NOCPU;
		__cpu_simple_unlock(&lock->mpl_lock);
	}
	splx(s);
}

__mp_unlock()を呼んでいるのは_kernel_proc_unlock()。
はて・・・。
Machine dependentなコードから初期プロセスの構造体に対してロックをかけたりする必要でもあるのか？
取り合えずMP_LOCKDEBUGを外せば文句言わなくなりそうだが・・・。