Comment # 7 on bug 922082 from Jiri Slaby

This is for Olaf, I think. It seems that the request was freed and
  memcpy(&request->vstor_packet, packet,
     (sizeof(struct vstor_packet) - vmscsi_size_delta));
then stores to a dangling pointer which used to be a valid one, it seems:
ffff8801...