(In reply to Christian König from comment #3)
> Good to know, David and I actually already fixed one cause for this. So I
> assumed that this should do it, but that obviously isn't the case.

FWIW, I hit it from the CS ioctl at least once, like in bug 106870.
Unfortunately, the other recent cases didn't seem to get captured in the log
files.

> Any usable way to reproduce the issue?

Not particularly, I'm afraid. My script just pulls LLVM, xserver, Mesa etc.
from Git, builds them and runs piglit.