I've been getting crashes with a mkfs --fs-feature-level=max-features with
2.6.36-rc and 2.6.37-rc.  A little printk sprinkled in
ocfs2_get_system_file_inode() shows the following behavior for the system file
cache:

OCFS2 Node Manager 1.5.0
OCFS2 1.5.0
(mount.ocfs2,1725,1):ocfs2_get_system_file_inode:121 Inode 0xd6450d20 for system
file 4:4294967295
(mount.ocfs2,1725,1):ocfs2_get_system_file_inode:123 Inode 0xd6450d20 after igrab
(mount.ocfs2,1725,1):ocfs2_get_system_file_inode:121 Inode 0xd644ece0 for system
file 2:4294967295
(mount.ocfs2,1725,1):ocfs2_get_system_file_inode:123 Inode 0xd644ece0 after igrab
(mount.ocfs2,1725,0):ocfs2_get_system_file_inode:121 Inode 0xd7cae6e4 for system
file 8:0
(mount.ocfs2,1725,0):ocfs2_get_system_file_inode:123 Inode 0xd7cae6e4 after igrab
(mount.ocfs2,1725,0):ocfs2_get_system_file_inode:121 Inode 0xd6452ca8 for system
file 9:0
(mount.ocfs2,1725,0):ocfs2_get_system_file_inode:123 Inode 0x  (null) after igrab
------------[ cut here ]------------
kernel BUG at /build/jlbec/linux-2.6/working/fs/ocfs2/sysfile.c:124!
invalid opcode: 0000 [#1] SMP 
last sysfs file: /sys/devices/virtual/block/loop0/removable
Modules linked in: ocfs2 jbd2 ocfs2_nodemanager configfs ocfs2_stackglue
quota_tree nfs fscache nfsd lockd nfs_acl auth_rpcgss sunrpc exportfs autofs4
loop psmouse rtc_cmos rtc_core i2c_piix4 rtc_lib i2c_core evdev serio_raw button
processor pcspkr ext3 jbd mbcache dm_mod sg sr_mod sd_mod cdrom ata_generic
pata_acpi ata_piix libata virtio_net floppy virtio_pci scsi_mod [last unloaded:
scsi_wait_scan]

Pid: 1725, comm: mount.ocfs2 Not tainted 2.6.37-rc6-kvm+ #213 /Bochs
EIP: 0060:[<dba905df>] EFLAGS: 00010246 CPU: 0
EIP is at ocfs2_get_system_file_inode+0x20b/0x37c [ocfs2]
EAX: 00000058 EBX: 00000000 ECX: d7559290 EDX: 0000008b
ESI: 00000009 EDI: d6452ca8 EBP: d19dfddc ESP: d19dfd8c
 DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068
Process mount.ocfs2 (pid: 1725, ti=d19de000 task=d7559290 task.ti=d19de000)
Stack:
 d6452ca8 00000000 00000002 00000000 d6dc3098 6870726f 645f6e61 303a7269
 00303030 d6dc3098 00000000 d6dc3000 d74e3600 00000000 d7cae6e4 00000008
 d19dfddc d6dc3000 00000009 00000000 d19dfe00 dba8d30b d6dc3260 dbaa7f28
Call Trace:
 [<dba8d30b>] ? ocfs2_mount_volume+0xb84/0xbac [ocfs2]
 [<dba8ef6d>] ? ocfs2_fill_super+0x13c5/0x1a2f [ocfs2]
 [<c105b072>] ? lock_release_non_nested+0x1ca/0x221
 [<c10c2d99>] ? mount_bdev+0x102/0x147
 [<dba8a00f>] ? ocfs2_mount+0x0/0x17 [ocfs2]

I've seen a few other crashes, like a "NULL pointer deref" at iput() in
ocfs2_fill_super(), but I think this all comes from the sysfile cache.

My workaround is to jump directly to _ocfs2_get_system_file_inode().  Not a
solution, but gets me going.

To be clear, this is all on a loopback device of a sparse file filesystem.

1) touch data.img
2) truncate data.img to 4G
3) losetup /dev/loop0 data.img
4) mkfs.ocfs2 -M local -J size=32M /dev/loop0
5) mount /dev/loop0 /mnt/tmp

*crash*

Eek, sorry:

mkfs.ocfs2 -M local -J size=32M --fs-feature-level=max-features /dev/loop0

The patch for the fix.
http://oss.oracle.com/pipermail/ocfs2-devel/2010-December/007642.html