Index: sys/i386/i386/machdep.c
===================================================================
RCS file: /home/ncvs/src/sys/i386/i386/machdep.c,v
retrieving revision 1.385.2.10
diff -u -r1.385.2.10 machdep.c
--- sys/i386/i386/machdep.c	2001/02/09 02:58:48	1.385.2.10
+++ sys/i386/i386/machdep.c	2001/02/28 02:05:26
@@ -392,6 +392,7 @@
 		bzero(mclrefcnt, mb_map_size / MCLBYTES);
 		mb_map = kmem_suballoc(kmem_map, (vm_offset_t *)&mbutl, &maxaddr,
 			mb_map_size);
+		mbtop_a = maxaddr;
 		mb_map->system_map = 1;
 	}
 
Index: sys/kern/uipc_mbuf.c
===================================================================
RCS file: /home/ncvs/src/sys/kern/uipc_mbuf.c,v
retrieving revision 1.51.2.3
diff -u -r1.51.2.3 uipc_mbuf.c
--- sys/kern/uipc_mbuf.c	2000/08/25 23:23:32	1.51.2.3
+++ sys/kern/uipc_mbuf.c	2001/02/28 02:12:59
@@ -56,6 +56,7 @@
 SYSINIT(mbuf, SI_SUB_MBUF, SI_ORDER_FIRST, mbinit, NULL)
 
 struct mbuf *mbutl;
+vm_offset_t mbtop_a;
 char	*mclrefcnt;
 struct mbstat mbstat;
 u_long	mbtypes[MT_NTYPES];
Index: sys/sys/mbuf.h
===================================================================
RCS file: /home/ncvs/src/sys/sys/mbuf.h,v
retrieving revision 1.44.2.8
diff -u -r1.44.2.8 mbuf.h
--- sys/sys/mbuf.h	2001/02/04 14:49:59	1.44.2.8
+++ sys/sys/mbuf.h	2001/02/28 02:32:20
@@ -419,6 +419,8 @@
 #define	MFREE(m, n) MBUFLOCK(						\
 	struct mbuf *_mm = (m);						\
 									\
+	KASSERT(((vm_offset_t)_mm >= (vm_offset_t)mbutl) &&		\
+	    ((vm_offset_t)_mm <= mbtop_a), ("Bogus free: %x", _mm));	\
 	KASSERT(_mm->m_type != MT_FREE, ("freeing free mbuf"));		\
 	mbtypes[_mm->m_type]--;						\
 	if (_mm->m_flags & M_EXT)					\
@@ -546,6 +548,7 @@
 extern	u_long		 mbtypes[MT_NTYPES]; /* per-type mbuf allocations */
 extern	int		 mbuf_wait;	/* mbuf sleep time */
 extern	struct mbuf	*mbutl;		/* virtual address of mclusters */
+extern	vm_offset_t	 mbtop_a;	/* virtual boundry address */
 extern	char		*mclrefcnt;	/* cluster reference counts */
 extern	union mcluster	*mclfree;
 extern	struct mbuf	*mmbfree;