More on this problem that might help you debug.
first an object is allocated, then it goes and finds some nvidia specific
data structure contained in that object (from what I can tell), then it
calls rm_alloc_agp_pages (which is a function that I don't have access to.
it is in the proprietary part of the driver I guess), then calls
nv_free_vm_object(). I suppose that rm_alloc_agp_pages could very well be
screwing up the vm object, in which case it's part of the proprietary
non-open-source part of the driver that's messing things up.
Just in case this helps anyone.