I do not really understand how do I do this, but sometimes, with a
fairly moderate serial traffic (9600, 8n1, short packets around 16
bytes, with pauses between each packet, waiting for an answer),
I manage to break ptys (and serial, that's why cc).

There are messages in syslog (not every time it happens. Seems to be
only the first time):
uart_close: bad serial port count; tty->count is 1, state->count is 0

Starting xterm:
xterm: Error 32, errno 2: No such file or directory
Reason: get_pty: not enough ptys

MC (in its broken way) says:
subshell.c: couldn't open master side of pty
pty_open_master: No such file or directory

There is a running process listening on ttyS0, which receives no data.
And if I run cat cat /dev/ttyS0, it freezes (no SIGINT, no reading).
Alt-SysRq-T of the cat:

 cat           D C01317DE     0  7837   5317                     (NOTLB)
 ea103e18 00000086 f7a337a4 c01317de 00000002 00000000 00000149 00000000
        e1f18380 ea103df4 ea103df4 00003081 b9401dab 000052b3 e1148df8 f7fd9c18
        00000282 ea103000 e1148c50 c0288e7e f7fd9c20 00000001 e1148c50 c011270f
 Call Trace:
  [<c01317de>] do_page_cache_readahead+0xb4/0x19b
  [<c0288e7e>] __down+0x7e/0x10a
  [<c011270f>] default_wake_function+0x0/0xc
  [<c028921b>] schedule+0x18b/0x4ba
  [<c0289064>] __down_failed+0x8/0xc
  [<c01f11b4>] .text.lock.serial_core+0x91/0x19d
  [<c01dacc8>] tty_fasync+0x6a/0xf1
  [<c01127e0>] __wake_up_locked+0x1f/0x21
  [<c01da369>] release_dev+0x32f/0x6e5
  [<c011270f>] default_wake_function+0x0/0xc
  [<c028906f>] __down_failed_interruptible+0x7/0xc
  [<c01da89b>] tty_open+0x17c/0x46b
  [<c014d7ea>] chrdev_open+0xba/0x1d0
  [<c0144d46>] dentry_open+0x130/0x167
  [<c0144c10>] filp_open+0x40/0x46
  [<c0144dc4>] get_unused_fd+0x47/0xcd
  [<c0151116>] getname+0x66/0x91
  [<c0144efc>] sys_open+0x37/0x66
  [<c0103d39>] sysenter_past_esp+0x52/0x71

Alt-SysRq-T of the process:

 ser2tcp       S 0567306B     0  5677      1               27623 (L-TLB)
 d7c8ee10 00000046 00000001 0567306b f6a29400 eb452a80 f6a29400 00004000
        6143f3ac 000052b1 defe87c0 00003784 61455490 000052b1 ea2b9508 0568d5db
        d7c8ee24 d7c8e000 e70c791c c028998d f6a295d8 f6a295d8 f6a295d8 c03144a8
 Call Trace:
  [<c028998d>] schedule_timeout+0x5a/0xa7
  [<c011c72e>] process_timeout+0x0/0x5
  [<c01deb39>] tty_wait_until_sent+0xa9/0xe6
  [<c011270f>] default_wake_function+0x0/0xc
  [<c025fd96>] tcp_transmit_skb+0x3eb/0x679
  [<c011270f>] default_wake_function+0x0/0xc
  [<c01efaf1>] uart_close+0xac/0x20e
  [<c01dacc8>] tty_fasync+0x6a/0xf1
  [<c01da369>] release_dev+0x32f/0x6e5
  [<c0261660>] tcp_send_fin+0x23e/0x279
  [<c02579ae>] tcp_close+0x270/0x55c
  [<c01476c2>] invalidate_inode_buffers+0x9/0x5d
  [<c015bd8f>] destroy_inode+0x35/0x37
  [<c01dabac>] tty_release+0x22/0x58
  [<c0146526>] __fput+0x9f/0xb7
  [<c0144f94>] filp_close+0x46/0x6f
  [<c011687d>] put_files_struct+0x7b/0xe1
  [<c0117596>] do_exit+0x141/0x3c0
  [<c011788d>] do_group_exit+0x2c/0x9b
  [<c0103d39>] sysenter_past_esp+0x52/0x71

The other interesting parts (kernel threads) of kmsg didn't fit :(

lspci, and .config attached.
Intel(R) Celeron(R) CPU 2.60GHz, fpu vme de pse tsc msr pae mce cx8
apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse
sse2 ss ht tm pbe cid.

lspci (short):
Host bridge: Silicon Integrated Systems [SiS] 650/M650 Host (rev 01)
PCI bridge: Silicon Integrated Systems [SiS] Virtual PCI-to-PCI bridge (AGP)
ISA bridge: Silicon Integrated Systems [SiS] SiS961 [MuTIOL Media IO]
SMBus: Silicon Integrated Systems [SiS]: Unknown device 0016
USB Controller: Silicon Integrated Systems [SiS] USB 1.0 Controller (rev 07)
USB Controller: Silicon Integrated Systems [SiS] USB 1.0 Controller (rev 07)
IDE interface: Silicon Integrated Systems [SiS] 5513 [IDE] (rev d0)
Multimedia audio controller: Silicon Integrated Systems [SiS] Sound Controller (rev a0)
Ethernet controller: Digital Equipment Corporation DECchip 21142/43 (rev 41)
Ethernet controller: Realtek Semiconductor Co., Ltd. RTL-8139/8139C/8139C+ (rev 10)
VGA compatible controller: ATI Technologies Inc Rage 128 Pro Ultra TF

A bit of .config:

CONFIG_X86=y
CONFIG_EXPERIMENTAL=y
CONFIG_CLEAN_COMPILE=y
CONFIG_BROKEN_ON_SMP=y
CONFIG_PREEMPT=y
CONFIG_NOHIGHMEM=y
CONFIG_REGPARM=y
CONFIG_ACPI=y
CONFIG_SERIO=y
CONFIG_SERIO_I8042=y
CONFIG_SERIO_SERPORT=m
CONFIG_SERIAL_8250=y
CONFIG_SERIAL_8250_CONSOLE=y
CONFIG_SERIAL_8250_NR_UARTS=4
CONFIG_SERIAL_CORE=y
CONFIG_SERIAL_CORE_CONSOLE=y
CONFIG_UNIX98_PTYS=y
CONFIG_DEBUG_KERNEL=y
CONFIG_EARLY_PRINTK=y
CONFIG_MAGIC_SYSRQ=y
CONFIG_DEBUG_SPINLOCK_SLEEP=y
CONFIG_4KSTACKS=y

--
Alex Riesen