it's very difficult to say without access to
a) the stack dump and
b) the kernel in question.
this is because it's hard to find this sort of problem without
knowing where the problem occurred. the stack dump
will provide addresses and the kernel image will be
enough to tie addresses to particular bits of code.

as an unrelated aside, this reference counting updates uninitialized memory.

/n/sources/plan9/sys/src/9/pc/usbohci.c:1454,1455
if(dirin == Dirout && bp)
_xinc(&bp->ref);

since the definition for _allocb is so

if((b = mallocz(sizeof(Block)+size+Hdrspc, 0)) == nil)
return nil;

b->next = nil;
b->list = nil;
b->free = 0;
b->flag = 0;
[...]

either the unused reference counting needs to be dropped, usbohci
needs to initialize its own reference count or _allocb needs to initialize
it to 1. i assume the reason blocks are not zeroed is for performance
reasons.

i'm not sure i understand a reference count for a Block, since i thought
part of deal was that each Block has a unique owner. am i wrong?

- erik