Same here also poweredge 2950:

[10836.939786] Eeek! page_mapcount(page) went negative! (-1)
[10836.939840]   page pfn = ffffffffffffffff
[10836.939867]   page->flags = 4
[10836.939891]   page->count = 0
[10836.939916]   page->mapping = 0000000000000000
[10836.939961]   vma->vm_ops = 0x0
[10836.939990]   vma->vm_file->f_op->mmap = xen_mmap_mem+0x0/0x40
[10836.940030] ------------[ cut here ]------------
[10836.940059] kernel BUG at /build/buildd/linux-2.6.24/debian/build/custom-source-xen/mm/rmap.c:631!
[10836.940109] invalid opcode: 0000 [1] SMP 
[10836.940143] CPU 3 
[10836.940169] Modules linked in: dcdbas acpi_cpufreq cpufreq_conservative cpufreq_userspace cpufreq_powersave cpufreq_stats cpufreq_ondemand freq_table ipmi_si ipmi_devintf ipmi_msghandler i2c_dev i2c_core bridge ipv6 video output battery container sbs sbshc dock ac iptable_filter ip_tables x_tables parport_pc lp parport loop af_packet usbhid hid iTCO_wdt iTCO_vendor_support psmouse serio_raw i5000_edac shpchp evdev pcspkr 8250_pnp 8250 serial_core edac_core button pci_hotplug ext3 jbd mbcache sr_mod cdrom ata_generic pata_acpi sd_mod sg qla2xxx ata_piix uhci_hcd scsi_transport_fc ehci_hcd bnx2 libata usbcore megaraid_sas scsi_tgt scsi_mod thermal processor fan fuse
[10836.940670] Pid: 10987, comm: smitest Not tainted 2.6.24-19-xen #1
[10836.940700] RIP: e030:[<ffffffff8028e78b>]  [<ffffffff8028e78b>] page_remove_rmap+0x12b/0x140
[10836.940757] RSP: e02b:ffff8803e7751d88  EFLAGS: 00010292
[10836.940787] RAX: 0000000000000045 RBX: ffff880005a10fc8 RCX: ffffffffff5f7000
[10836.940819] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffff8058be64
[10836.940850] RBP: ffff8803e5f32720 R08: 0000000000000042 R09: 00000000ffffffff
[10836.940882] R10: 0000000000000000 R11: 0000000000000000 R12: 00007fdb23600000
[10836.940915] R13: 0000000000000020 R14: ffff880005a10fc8 R15: 00007fdb23604000
[10836.940949] FS:  00007fdb236046f0(0000) GS:ffffffff805c6180(0000) knlGS:0000000000000000
[10836.940997] CS:  e033 DS: 0000 ES: 0000
[10836.941023] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[10836.941056] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
[10836.941088] Process smitest (pid: 10987, threadinfo ffff8803e7750000, task ffff8803e526b040)
[10836.941137] Stack:  00000000000000e0 ffff8803e7efefa8 00007fdb235f5000 ffffffff80283bb7
[10836.941203]  ffffffff8061a420 ffff880001ae3438 00007fdb23603fff 0000000000000000
[10836.941263]  ffff8803e7751eb0 00007fdb23604000 00007fdb235f4000 ffff8803e5f32720
[10836.941304] Call Trace:
[10836.941350]  [<ffffffff80283bb7>] unmap_vmas+0x687/0xb20
[10836.941387]  [<ffffffff80289b08>] unmap_region+0xc8/0x160
[10836.941419]  [<ffffffff8028aa2a>] do_munmap+0x22a/0x2f0
[10836.941450]  [<ffffffff80471122>] __down_write_nested+0x12/0x100
[10836.941483]  [<ffffffff8028ab3d>] sys_munmap+0x4d/0x80
[10836.941514]  [<ffffffff8020c698>] system_call+0x68/0x6d
[10836.941545]  [<ffffffff8020c630>] system_call+0x0/0x6d
[10836.941575] 
[10836.941597] 
[10836.941597] Code: 0f 0b eb fe 48 8b 53 10 e9 65 ff ff ff 0f 1f 84 00 00 00 00 
[10836.941742] RIP  [<ffffffff8028e78b>] page_remove_rmap+0x12b/0x140
[10836.941776]  RSP <ffff8803e7751d88>
[10836.942410] ---[ end trace 7661131973aa5235 ]---