Null pointer at "data16" instruction??

[Bandaid]

I had a panic in smbd:

crash> log | grep -A 1 NULL
(U1)(MSG-KERN-00009):[1272501291.384650] Unable to handle kernel NULL pointer dereference at 0000000000000010 RIP:
(E1)[1272501291.486584] <ffffffff802570b9>{copy_user_generic+169}

"Great" I thought to myself, "a samba bug"..but then I looked at the panic, and the actual instruction is "data16":

0xffffffff802570b2 <copy_user_generic+162>:     mov    %edx,%ecx
0xffffffff802570b4 <copy_user_generic+164>:     and    $0x7,%ecx
0xffffffff802570b7 <copy_user_generic+167>:     je     0xffffffff802570ce <copy_user_generic+190>
0xffffffff802570b9 <copy_user_generic+169>:     data16
0xffffffff802570ba <copy_user_generic+170>:     data16
0xffffffff802570bb <copy_user_generic+171>:     data16
0xffffffff802570bc <copy_user_generic+172>:     nop
0xffffffff802570bd <copy_user_generic+173>:     data16
0xffffffff802570be <copy_user_generic+174>:     data16

That doesn't make any sense to me, data16 shouldn't do any memory reference (right?), nothing else seems obviously funky...any ideas what might have happened here?

[Rubberman]

I'd also check +190 which is the target address of the jump (je) at +167. Sometimes these dumps show the address right after where the error really occurred. Anyway, just a SWAG...