Okay, it seems this was due to a double free in error handling in my modified version of cifs. The reason it's happening in the maple tree code is that the netfs_io_subrequest struct might match the size of the maple tree nodes and be sharing a slab. David
