FreeBSD Security Advisory FreeBSD-SA-06:10.nfs – A part of the NFS server code charged with handling incoming RPC messages via TCP had an error which, when the server received a message with a zero-length payload, would cause a NULL pointer dereference which results in a kernel panic. The kernel will only process the RPC messages if a userland nfsd daemon is running.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/44312/FreeBSD-SA-06-10.nfs.txt
Source: https://packetstormsecurity.com/files/44312/FreeBSD-SA-06-10.nfs.txt.html