apparent ubareset bug

[utzoo!decvax!harpo!utah-cs!thomas]

When ubareset is called, it calls a reset routine for each device.  These
routines each do a ubarelse() call if they have allocated a hunk of unibus
map.  However, ubareset() has called ubainitmaps() which called rminit()
which freed the entire unibus map.  Thus, the call to ubarelse() (which calls
rmfree()) produces a "bad rmfree" panic and crashes the system.  Not a very
good result.  In particular, the dh driver will ALWAYS produce this
crash, since it allocates a piece of unibus map permanently.  Is this
really a bug?  If so, why has no one found it before now?  I have replaced
all such calls to ubarelse(ubanum, thing) with thing=0.  I think it will
work (as yet untested).  I will report if it turns out otherwise.

Any thoughts out there about this?

=Spencer