Index: sys/pool.h
===================================================================
RCS file: /cvs/src/sys/sys/pool.h,v
retrieving revision 1.57
diff -u -p -r1.57 pool.h
--- sys/pool.h	10 Feb 2015 06:16:13 -0000	1.57
+++ sys/pool.h	28 Aug 2015 04:21:41 -0000
@@ -119,6 +119,7 @@ struct pool {
 #define PR_ZERO		0x0008 /* M_ZERO */
 #define PR_WANTED	0x0100
 #define PR_DEBUGCHK	0x1000
+	u_int		pr_flags;
 
 	int		pr_ipl;
 
Index: kern/subr_pool.c
===================================================================
RCS file: /cvs/src/sys/kern/subr_pool.c,v
retrieving revision 1.188
diff -u -p -r1.188 subr_pool.c
--- kern/subr_pool.c	21 Aug 2015 03:03:44 -0000	1.188
+++ kern/subr_pool.c	28 Aug 2015 04:21:41 -0000
@@ -312,6 +312,7 @@ pool_init(struct pool *pp, size_t size, 
 	pp->pr_hiwat = 0;
 	pp->pr_nidle = 0;
 
+	pp->pr_flags = flags;
 	pp->pr_ipl = -1;
 	mtx_init(&pp->pr_mtx, IPL_NONE);
 	mtx_init(&pp->pr_requests_mtx, IPL_NONE);
@@ -588,7 +589,20 @@ pool_do_get(struct pool *pp, int flags, 
 	XSIMPLEQ_REMOVE_HEAD(&ph->ph_itemlist, pi_list);
 
 #ifdef DIAGNOSTIC
-	if (pool_debug && POOL_PHPOISON(ph)) {
+	if (ISSET(pp->pr_flags, PR_DEBUGCHK)) {
+		uint32_t pval, *p, *e;
+
+		pval = poison_value(pi);
+		e = (uint32_t *)((uint8_t *)pi + pp->pr_size);
+		for (p = (uint32_t *)(pi + 1); p < e; p++) {
+			if (*p != pval) {
+				panic("%s: %s free list modified: "
+				    "page %p; item addr %p; %p 0x%x!=0x%x",
+				    __func__, pp->pr_wchan, ph->ph_page, pi,
+				    p, *p, pval);
+			}
+		}
+	} else if (pool_debug && POOL_PHPOISON(ph)) {
 		size_t pidx;
 		uint32_t pval;
 		if (poison_check(pi + 1, pp->pr_size - sizeof(*pi),
@@ -664,7 +678,14 @@ pool_put(struct pool *pp, void *v)
 	pi->pi_magic = POOL_IMAGIC(ph, pi);
 	XSIMPLEQ_INSERT_HEAD(&ph->ph_itemlist, pi, pi_list);
 #ifdef DIAGNOSTIC
-	if (POOL_PHPOISON(ph))
+	if (ISSET(pp->pr_flags, PR_DEBUGCHK)) {
+		uint32_t pval, *p, *e;
+
+		pval = poison_value(pi);
+		e = (uint32_t *)((uint8_t *)pi + pp->pr_size);
+		for (p = (uint32_t *)(pi + 1); p < e; p++)
+			*p = pval;
+	} else if (POOL_PHPOISON(ph))
 		poison_mem(pi + 1, pp->pr_size - sizeof(*pi));
 #endif /* DIAGNOSTIC */
 
@@ -787,7 +808,14 @@ pool_p_alloc(struct pool *pp, int flags,
 		XSIMPLEQ_INSERT_TAIL(&ph->ph_itemlist, pi, pi_list);
 
 #ifdef DIAGNOSTIC
-		if (POOL_PHPOISON(ph))
+		if (ISSET(pp->pr_flags, PR_DEBUGCHK)) {
+			uint32_t pval, *p, *e;
+
+			pval = poison_value(pi);
+			e = (uint32_t *)((uint8_t *)pi + pp->pr_size);
+			for (p = (uint32_t *)(pi + 1); p < e; p++)
+				*p = pval;
+		} else if (POOL_PHPOISON(ph))
 			poison_mem(pi + 1, pp->pr_size - sizeof(*pi));
 #endif /* DIAGNOSTIC */
 
@@ -1187,7 +1215,21 @@ pool_chk_page(struct pool *pp, struct po
 		}
 
 #ifdef DIAGNOSTIC
-		if (POOL_PHPOISON(ph)) {
+		if (ISSET(pp->pr_flags, PR_DEBUGCHK)) {
+			uint32_t pval, *p, *e;
+
+			pval = poison_value(pi);
+			e = (uint32_t *)((uint8_t *)pi + pp->pr_size);
+			for (p = (uint32_t *)(pi + 1); p < e; p++) {
+				if (*p != pval) {
+					panic("%s: %s free list modified: "
+					    "page %p; item addr %p; "
+					    "%p 0x%x!=0x%x", __func__,
+					    pp->pr_wchan, ph->ph_page, pi,
+					    p, *p, pval);
+				}
+			}
+		} else if (POOL_PHPOISON(ph)) {
 			size_t pidx;
 			uint32_t pval;
 			if (poison_check(pi + 1, pp->pr_size - sizeof(*pi),