Index: linux-2.6.11/mm/slab.c
===================================================================
--- linux-2.6.11.orig/mm/slab.c	2005-03-02 08:38:38.000000000 +0100
+++ linux-2.6.11/mm/slab.c	2005-07-07 16:49:49.000000000 +0200
@@ -1007,6 +1007,9 @@ static void print_objinfo(kmem_cache_t *
 	int i, size;
 	char *realobj;
 
+	if (cachep->name) {
+		printk(KERN_ERR "Slab name: %s\n", cachep->name);
+	}
 	if (cachep->flags & SLAB_RED_ZONE) {
 		printk(KERN_ERR "Redzone: 0x%lx/0x%lx.\n",
 			*dbg_redzone1(cachep, objp),
@@ -1021,6 +1024,8 @@ static void print_objinfo(kmem_cache_t *
 		printk("\n");
 	}
 	realobj = (char*)objp+obj_dbghead(cachep);
+	printk("Phys:    0x%08lx\n", __pa(realobj));
+	printk("Machine: 0x%08lx\n", virt_to_machine(realobj));
 	size = obj_reallen(cachep);
 	for (i=0; i<size && lines;i+=16, lines--) {
 		int limit;
@@ -1049,8 +1054,8 @@ static void check_poison_obj(kmem_cache_
 			/* Mismatch ! */
 			/* Print header */
 			if (lines == 0) {
-				printk(KERN_ERR "Slab corruption: start=%p, len=%d\n",
-						realobj, size);
+				printk(KERN_ERR "Slab corruption: start=%p, i=%d, len=%d\n",
+						realobj, i, size);
 				print_objinfo(cachep, objp, 0);
 			}
 			/* Hexdump the affected line */
@@ -2294,9 +2299,17 @@ static inline void __cache_free (kmem_ca
  * Allocate an object from this cache.  The flags are only relevant
  * if the cache has no available objects.
  */
+
+extern kmem_cache_t *skbuff_cachep; /* in arch/xen/kernel/skbuff.c */
+
 void * kmem_cache_alloc (kmem_cache_t *cachep, int flags)
 {
-	return __cache_alloc(cachep, flags);
+	void *rc = __cache_alloc(cachep, flags);
+
+	if (skbuff_cachep == cachep) {
+//		printk("%s: %p\n", __FUNCTION__, rc);
+	}
+	return rc;
 }
 
 EXPORT_SYMBOL(kmem_cache_alloc);
@@ -2530,6 +2543,9 @@ void kmem_cache_free (kmem_cache_t *cach
 {
 	unsigned long flags;
 
+	if (skbuff_cachep == cachep) {
+//		printk("%s: %p\n", __FUNCTION__, objp);
+	}
 	local_irq_save(flags);
 	__cache_free(cachep, objp);
 	local_irq_restore(flags);
@@ -2575,6 +2591,9 @@ void kfree (const void *objp)
 	local_irq_save(flags);
 	kfree_debugcheck(objp);
 	c = GET_PAGE_CACHE(virt_to_page(objp));
+	if (skbuff_cachep == c) {
+//		printk("%s: %p\n", __FUNCTION__, objp);
+	}
 	__cache_free(c, (void*)objp);
 	local_irq_restore(flags);
 }
Index: linux-2.6.11/arch/xen/kernel/skbuff.c
===================================================================
--- linux-2.6.11.orig/arch/xen/kernel/skbuff.c	2005-07-07 11:04:31.000000000 +0200
+++ linux-2.6.11/arch/xen/kernel/skbuff.c	2005-07-07 14:09:37.000000000 +0200
@@ -27,6 +27,8 @@ EXPORT_SYMBOL(__dev_alloc_skb);
 struct sk_buff *__dev_alloc_skb(unsigned int length, int gfp_mask)
 {
     struct sk_buff *skb;
+
+    BUG_ON(length+16 > PAGE_SIZE);
     skb = alloc_skb_from_cache(skbuff_cachep, length + 16, gfp_mask);
     if ( likely(skb != NULL) )
         skb_reserve(skb, 16);
Index: linux-2.6.11/drivers/xen/netback/netback.c
===================================================================
--- linux-2.6.11.orig/drivers/xen/netback/netback.c	2005-07-07 11:04:31.000000000 +0200
+++ linux-2.6.11/drivers/xen/netback/netback.c	2005-07-07 17:06:54.000000000 +0200
@@ -88,12 +88,16 @@ static unsigned long alloc_mfn(void)
     if ( alloc_index != 0 )
         mfn = mfn_list[--alloc_index];
     spin_unlock_irqrestore(&mfn_lock, flags);
+    printk("%s: mfn 0x%05lx, pfn 0x%05lx, index %d\n",
+	   __FUNCTION__, mfn, mfn_to_pfn(mfn), alloc_index);
     return mfn;
 }
 
 static void free_mfn(unsigned long mfn)
 {
     unsigned long flags;
+
+    printk("%s: mfn 0x%05lx, pfn 0x%05lx\n", __FUNCTION__, mfn, mfn_to_pfn(mfn));
     spin_lock_irqsave(&mfn_lock, flags);
     if ( alloc_index != MAX_MFN_ALLOC )
         mfn_list[alloc_index++] = mfn;
@@ -151,6 +155,8 @@ int netif_be_start_xmit(struct sk_buff *
         struct sk_buff *nskb = dev_alloc_skb(hlen + skb->len);
         if ( unlikely(nskb == NULL) )
             goto drop;
+	printk("%s: copy  skb %p/%p  ->  nskb %p/%p, hlen %d\n", __FUNCTION__,
+	       skb, skb->data, nskb, nskb->data, hlen);
         skb_reserve(nskb, hlen);
         __skb_put(nskb, skb->len);
         if (skb_copy_bits(skb, -hlen, nskb->data - hlen, skb->len + hlen))