This problem was found while testing Sun ONE Message Queue 3.5 (Build 330-R) 
on J2SE 1.4.2_02, Solaris 9u4 x86. For more details on that test case see 
MQ bug 4939923. It involves performing IO on large (50MB) chunks of data.

During the test the broker (our server component) threw the following exception:

17/Oct/2003:16:14:32 PDT] WARNING [B3100]: Unexpected Broker Internal Error : [
sun.nio.ch.DevPollSelectorImpl@1bc4ec8] :
java.lang.NullPointerException
        at sun.nio.ch.Util.releaseTemporaryDirectBuffer(Util.java:70)
        at sun.nio.ch.IOUtil.read(IOUtil.java:212)
        at sun.nio.ch.SocketChannelImpl.read(SocketChannelImpl.java:207)
        at com.sun.messaging.jmq.io.Packet.myChannelRead(Packet.java:1882)
        at com.sun.messaging.jmq.io.Packet.readRestOfPacket(Packet.java:1153)
        at com.sun.messaging.jmq.io.Packet.readPacket(Packet.java:1025)
        at com.sun.messaging.jmq.jmsserver.service.imq.IMQConnection.readData(IM
QConnection.java:1635)
        at com.sun.messaging.jmq.jmsserver.service.imq.group.ReadThread.process(
ReadThread.java:57)
        at com.sun.messaging.jmq.jmsserver.service.imq.group.SelectThread.proces
sThread(SelectThread.java:353)
        at com.sun.messaging.jmq.jmsserver.service.imq.group.GroupRunnable.proce
ss(GroupRunnable.java:116)
        at com.sun.messaging.jmq.jmsserver.util.pool.BasicRunnable.run(BasicRunn
able.java:455)
        at java.lang.Thread.run(Thread.java:534)

On code inspection of sun/nio/ch/Util.java I see the following:

    66          // Otherwise replace a smaller one in the cache if such exists
    67          for (int i=0; i<TEMP_BUF_POOL_SIZE; i++) {
    68              SoftReference ref = (SoftReference)(bufferPool[i].get());
    69              ByteBuffer inCacheBuf = (ByteBuffer)ref.get();
    70              if (buf.capacity() > inCacheBuf.capacity()) {
    71                  bufferPool[i].set(new SoftReference(buf));
    72                  return;
    73              }
    74          }

It seems to me that on line 69 inCacheBuf could be null if the soft reference 
has been cleared.