I take back what I said in comment 3, for me the lockup is cased by the same thing in bug 53111 (virtual address space active on cayman).