Context:

For an object type, we maintain a variable mb_mapfull. It is 0 by default
and is only raised to 1 in one place: when an mb_pop_cont() fails for
the first time, on the assumption that the reason for the failure is
due to the underlying map for the object (e.g. clust_map, mbuf_map) being
exhausted.

Problem and Changes:
Change how we define "mb_mapfull." It now means: "set to 1 when the first
mb_pop_cont() fails only in the kmem_malloc()-ing of the object, and
only if the call was with the M_TRYWAIT flag." This is a more conservative
definition and should avoid odd [but theoretically possible] situations
from occuring. i.e. we had set mb_mapfull to 1 thinking the map for the
object was actually exhausted when we _actually_ failed in malloc()ing
the space for the bucket structure managing the objects in the page
we're allocating.

sys/kern/subr_mbuf.c

@@ -507,6 +507,8 @@ mb_pop_cont(struct mb_lstmngr *mb_list, int how, struct mb_pcpu_list *cnt_lst)
 	    how == M_TRYWAIT ? M_WAITOK : M_NOWAIT);
 	if (p == NULL) {
 		free(bucket, M_MBUF);
+		if (how == M_TRYWAIT)
+			mb_list->ml_mapfull = 1;
 		return (NULL);
 	}
 
@@ -618,7 +620,6 @@ mb_alloc(struct mb_lstmngr *mb_list, int how, short type)
 			 	   * we're willing to, but only after trying to
 				   * steal from other lists.
 				   */
-					mb_list->ml_mapfull = 1;
 					m = mb_alloc_wait(mb_list, type);
 				} else
 					/* XXX: No consistency. */