[Sony Xperia S, Acro S, Ion] letama:
A bit further down, msm_bus_rpm is responsible for it:

<4>[ 7.493445] P:mdp_bus_scale_update_request(h=E4D54400, i=4)
<4>[ 7.493452] P:scale(E4D54400, 4)
<4>[ 7.493470] P:update_path: 2070 2070 2 2100000000 850000000 0 0 0
<4>[ 7.493476] P:ndx=2
<4>[ 7.493485] PL:id: 2070
<4>[ 7.493492] P:fabric: 2048 slave: 2576, slave-width: 16 info: 2070
<4>[ 7.493499] P:rpm_update_bw
<4>[ 7.493504] P:rpm:add_bw=850000000, ports=1, tiers=1
<4>[ 7.493511] P:hop_tier=0, nmasters=14, masterp[j]=4676
<4>[ 7.493518] P:tieredbw=391332768
<4>[ 7.493522] P:tieredbw bis=391332768
<4>[ 7.493530] P:rpm, index=4676, tier:0 mport: 4676 tiered_bw:391332768 bwsum: 850000000, i=0, j=0
<4>[ 7.493539] P:update-clks: curr_hz: 0, req_hz: 2100000000, bw_hz 3976
<4>[ 7.493554] P:update_path: 2070 2070 2 2100000000 850000000 0 0 1
<4>[ 7.493560] P:ndx=2
<4>[ 7.493567] PL:id: 2070
<4>[ 7.493572] P:fabric: 2048 slave: 2576, slave-width: 16 info: 2070
<4>[ 7.493578] P:rpm_update_bw
<4>[ 7.493583] P:rpm:add_bw=850000000, ports=1, tiers=1
<4>[ 7.493589] P:hop_tier=0, nmasters=14, masterp[j]=4676
<4>[ 7.494010] P:tieredbw=-212889112
<4>[ 7.494016] P:tieredbw bis=-212889112
<4>[ 7.494023] P:########## first corruption (F34F91E8) (rpm5)!!! #############
<4>[ 7.494030] Backtrace:
<4>[ 7.494056] [<c010a164>] (dump_backtrace+0x0/0x10c) from [<c089dfd4>] (dump_stack+0x18/0x1c)
<4>[ 7.494064] r6:e4a97840 r5:00000000 r4:c0d68360 r3:271aed2f
<4>[ 7.494087] [<c089dfbc>] (dump_stack+0x0/0x1c) from [<c02c3378>] (pcheck+0x50/0x70)
<4>[ 7.494105] [<c02c3328>] (pcheck+0x0/0x70) from [<c0172d18>] (msm_bus_rpm_update_bw+0x30c/0x3c0)
<4>[ 7.494112] r4:00000000 r3:e4a916c0
<4>[ 7.494125] [<c0172a0c>] (msm_bus_rpm_update_bw+0x0/0x3c0) from [<c0170b28>] (msm_bus_fabric_update_bw+0x60/0x6c)
<4>[ 7.494138] [<c0170ac8>] (msm_bus_fabric_update_bw+0x0/0x6c) from [<c017140c>] (update_path+0x310/0x548)
<4>[ 7.494147] r5:e4aa7a00 r4:e4a97840
<4>[ 7.494159] [<c01710fc>] (update_path+0x0/0x548) from [<c0171e3c>] (msm_bus_scale_client_update_request+0x1c8/0x378)
<4>[ 7.494180] [<c0171c74>] (msm_bus_scale_client_update_request+0x0/0x378) from [<c0427e90>] (mdp_bus_scale_update_request+0x50/0xc4)
<4>[ 7.494196] [<c0427e40>] (mdp_bus_scale_update_request+0x0/0xc4) from [<c0432980>] (mdp4_overlay_mdp_perf_upd+0x2f4/0x3d8)
<4>[ 7.494205] r4:c0c664f8 r3:271aed2f
<4>[ 7.494219] [<c043268c>] (mdp4_overlay_mdp_perf_upd+0x0/0x3d8) from [<c04375f4>] (mdp4_dsi_video_overlay+0x80/0x110)
<4>[ 7.494226] r7:41dd7000 r6:c0d708c0 r5:c0c64514 r4:e4a13260
<4>[ 7.494245] [<c0437574>] (mdp4_dsi_video_overlay+0x0/0x110) from [<c043c5c8>] (mdp_dma_pan_update+0x70/0x74)
<4>[ 7.494254] r7:e4dc7400 r6:e4a13034 r5:e4a13260 r4:e4a13260
<4>[ 7.494270] [<c043c558>] (mdp_dma_pan_update+0x0/0x74) from [<c04220b8>] (msm_fb_pan_display+0x194/0x380)
<4>[ 7.494278] r5:e4a13260 r4:e4a13000
<4>[ 7.494297] [<c0421f24>] (msm_fb_pan_display+0x0/0x380) from [<c0419244>] (fb_pan_display+0xbc/0x138)
<4>[ 7.494311] [<c0419188>] (fb_pan_display+0x0/0x138) from [<c0419c84>] (fb_set_var+0x140/0x298)
<4>[ 7.494325] [<c0419b44>] (fb_set_var+0x0/0x298) from [<c041a28c>] (do_fb_ioctl+0x4b0/0x5dc)
<4>[ 7.494338] [<c0419ddc>] (do_fb_ioctl+0x0/0x5dc) from [<c041a3fc>] (fb_ioctl+0x44/0x54)
<4>[ 7.494345] r8:c01062e8 r7:0000000e r6:00004601 r5:40bf90cc r4:e3d51238
<4>[ 7.494365] [<c041a3b8>] (fb_ioctl+0x0/0x54) from [<c0272054>] (do_vfs_ioctl+0x88/0x5ec)
<4>[ 7.494377] [<c0271fcc>] (do_vfs_ioctl+0x0/0x5ec) from [<c02725f8>] (sys_ioctl+0x40/0x64)
<4>[ 7.494384] r9:e36c4000 r8:c01062e8 r7:0000000e r6:00004601 r5:40bf90cc
<4>[ 7.494396] r4:e36573c0
<4>[ 7.494407] [<c02725b8>] (sys_ioctl+0x0/0x64) from [<c0106140>] (ret_fast_syscall+0x0/0x30)
<4>[ 7.494415] r7:00000036 r6:00000001 r5:41d6b9b8 r4:40bf9000
<4>[ 7.494425] P:############################################
<4>[ 7.494433] P:rpm, index=4676, tier:0 mport: 4676 tiered_bw:-212889112 bwsum: 850000000, i=0, j=0

Notice masterp[j]=4676 ? it's used as an array index and I think it's messed up. On stock kernel, masterp[j] is more like 0 to 4. Roughly equivalent trace on stock:

<4>[ 6.073447] P:***** mdp4_overlay_mdp_perf_upd->mdp_bus_scale_update_request(5) ****
<4>[ 6.073626] P:mdp_bus_scale_update_request(h=DAC24DE0, i=5)
<4>[ 6.073730] P:update_path: 2070 2070 0 2100000000 850000000 0 0 0
<4>[ 6.073895] P:fabric: 2048 slave: 2576, slave-width: 16 info: 2070
<4>[ 6.073985] P:msm_bus_rpm_update_bw
<4>[ 6.074178] P:rpm:add_bw=850000000, ports=1, tiers=1
<4>[ 6.074356] P:hop_tier=0, nmasters=14, masterp[j]=0
<4>[ 6.074448] P:rpm, index=0, tier:0 mport: 0 tiered_bw:850000000 bwsum: 850000000, i=0, j=0
<4>[ 6.074619] P:update_path: 2070 2070 0 2100000000 850000000 0 0 1
<4>[ 6.074777] P:fabric: 2048 slave: 2576, slave-width: 16 info: 2070
<4>[ 6.074867] P:msm_bus_rpm_update_bw
<4>[ 6.074954] P:rpm:add_bw=850000000, ports=1, tiers=1
<4>[ 6.075109] P:hop_tier=0, nmasters=14, masterp[j]=0
<4>[ 6.075198] P:rpm, index=0, tier:0 mport: 0 tiered_bw:850000000 bwsum: 850000000, i=0, j=0
<4>[ 6.075367] P:update_path: 2070 2070 1 2100000000 850000000 1019520000 407808000 0
<4>[ 6.075532] P:fabric: 2048 slave: 0, slave-width: 16 info: 2070
<4>[ 6.075621] P:msm_bus_rpm_update_bw
<4>[ 6.075774] P:rpm:add_bw=442192000, ports=1, tiers=1
<4>[ 6.075861] P:hop_tier=1, nmasters=14, masterp[j]=0
<4>[ 6.075951] P:rpm, index=14, tier:1 mport: 0 tiered_bw:850000000 bwsum: 850000000, i=0, j=0
<4>[ 6.076117] P:fabric: 0 slave: 512, slave-width: 8 info: 0
<4>[ 6.076271] P:msm_bus_rpm_update_bw
<4>[ 6.076358] P:rpm:add_bw=442192000, ports=1, tiers=1
<4>[ 6.076447] P:hop_tier=0, nmasters=4, masterp[j]=2
<4>[ 6.076602] P:rpm, index=2, tier:0 mport: 2 tiered_bw:850000000 bwsum: 850000000, i=0, j=0
<4>[ 6.076771] P:update_path: 2070 2070 1 2100000000 850000000 1019520000 407808000 1
<4>[ 6.076867] P:fabric: 2048 slave: 0, slave-width: 16 info: 2070
<4>[ 6.077023] P:msm_bus_rpm_update_bw
<4>[ 6.077111] P:rpm:add_bw=442192000, ports=1, tiers=1
<4>[ 6.077200] P:hop_tier=1, nmasters=14, masterp[j]=0
<4>[ 6.077357] P:rpm, index=14, tier:1 mport: 0 tiered_bw:850000000 bwsum: 850000000, i=0, j=0

Backtrace location in msm_bus_rpm.c is there :

/* Update Arb for fab,get HW Mport from enum */
sel_cd->arb[index] =
msm_bus_create_bw_tier_pair_bytes(tier,
tieredbw);
sel_cd->actarb[index] = tieredbw;
pcheck("rpm5");

Next step, understand why masterp[j] is messed up... :)