David, Willy pointed me to the recent splice crash fix (do_tcp_sendpages and non-0-order pages). It's apparently easily user-triggerable.. Should I take the patch directly, or do you have a tree to pull. Don't want to make a release with a known oopser..