Dave,

lockdep caught this held-lock-freed incident in the networking code:

[   21.121321] EXT3-fs (sda5): using internal journal
[   21.127218] EXT3-fs (sda5): mounted filesystem with ordered data mode
[   22.034265] rc.sysinit used greatest stack depth: 5796 bytes left
[   22.511213] IPv4 FIB: Using LC-trie version 0.409
[   22.646483] 
[   22.646484] =========================
[   22.648398] [ BUG: held lock freed! ]
[   22.648398] -------------------------
[   22.648398] ifconfig/329 is freeing memory f5d01680-f5d018ff, with a lock still held there!
[   22.648398]  (sk_lock-AF_IPX){......}, at: [<c1c345b1>] ipx_release+0x21/0xf0
[   22.648398] 1 lock held by ifconfig/329:
[   22.648398]  #0:  (sk_lock-AF_IPX){......}, at: [<c1c345b1>] ipx_release+0x21/0xf0
[   22.648398] 
[   22.648398] stack backtrace:
[   22.648398] Pid: 329, comm: ifconfig Not tainted 2.6.38-tip+ #109381
[   22.648398] Call Trace:
[   22.648398]  [<c1d3dd48>] ? printk+0x2d/0x2f
[   22.648398]  [<c1067aab>] debug_check_no_locks_freed+0x10b/0x130
[   22.648398]  [<c10eae01>] kmem_cache_free+0x61/0x120
[   22.648398]  [<c1b1135c>] ? __sk_free+0xbc/0x150
[   22.648398]  [<c1b1135c>] __sk_free+0xbc/0x150
[   22.648398]  [<c1b17964>] ? skb_dequeue+0x44/0x60
[   22.648398]  [<c1b11ee5>] sk_free+0x25/0x30
[   22.648398]  [<c1c34647>] ipx_release+0xb7/0xf0
[   22.648398]  [<c1b0e386>] sock_release+0x16/0x60
[   22.648398]  [<c1b0e3e5>] sock_close+0x15/0x30
[   22.648398]  [<c1b0e3d0>] ? sock_close+0x0/0x30
[   22.648398]  [<c10f33cc>] fput+0xcc/0x260
[   22.648398]  [<c10f112a>] filp_close+0x4a/0x80
[   22.648398]  [<c103a7c6>] put_files_struct+0x146/0x170
[   22.648398]  [<c103a6b0>] ? put_files_struct+0x30/0x170
[   22.648398]  [<c103a87c>] exit_files+0x3c/0x50
[   22.648398]  [<c103abac>] do_exit+0x10c/0x770
[   22.648398]  [<c10f1d50>] ? vfs_write+0xf0/0x160
[   22.648398]  [<c10f1b80>] ? do_sync_write+0x0/0xe0
[   22.648398]  [<c103b284>] do_group_exit+0x34/0x90
[   22.648398]  [<c103b2f8>] sys_exit_group+0x18/0x20
[   22.648398]  [<c1d52597>] sysenter_do_call+0x12/0x32

Not sure whether it's VFS or networking related - my guess it's the latter.
The bug was introduced between 016aa2ed1cc9 and a44f99c7efdb.

The box has booted up fine after the lockdep report. Config attached.

Thanks,

	Ingo