And it's still in 2.6.36-rc4. I added a kfree(parser->track) in r600_cs_parser_fini in r600_cs.c as per David's suggestion without any noticeable effect. Does anyone know how could we go about debugging this? Regards, -- Eduardo.