panic: assertion: _ifac->ifa_magic == IFA_CONTAINER_MAGIC in _IFAFREE

[YONETANI Tomokazu <qhwt+dfly@xxxxxxxxxx>]

Hello.
Just caught a panic while playing with NFS mounted git tree
(but I cannot reliably reproduce it after that):

panic: assertion: _ifac->ifa_magic == IFA_CONTAINER_MAGIC in _IFAFREE
mp_lock = 00000001; cpuid = 1
		:

and the backtrace below the panic is as follows:

#9  0xc032907e in rtfree (rt=0xc116ca60)
    at /home/dfly/current/sys/net/if_var.h:469
#10 0xc034e8ed in ip_output (m0=0xcc2fd100, opt=0x0, ro=0xc9ebde3c, 
    flags=<value optimized out>, imo=0x0, inp=0xc9ebde00)
    at /home/dfly/current/sys/netinet/ip_output.c:245
#11 0xc035c527 in udp_send (so=0xc9de17a0, flags=0, m=0xcc2fed00, addr=0x0, 
    control=0x0, td=0xc8afc500)
    at /home/dfly/current/sys/netinet/udp_usrreq.c:781
#12 0xc02ea5ff in netmsg_pru_send (msg=0xcc33da70)
    at /home/dfly/current/sys/kern/uipc_msg.c:527
#13 0xc03274e6 in netmsg_service_loop (arg=0x0)
    at /home/dfly/current/sys/net/netisr.c:242
#14 0xc02c1ad5 in lwkt_deschedule_self (td=Cannot access memory at address 0x8
)
    at /home/dfly/current/sys/kern/lwkt_thread.c:214

This is with an SMP kernel (just added SMP and APIC_IO to GENERIC config)
built from source tree as of March 10-11.  The kernel is running on VMware
and the host OS is exporting the git tree via NFS.  Before seeing the panic,
(but not right before the panic) the system clock on the guest OS skewed
about 20000 seconds by rdate command after resuming the host OS from sleep.
I'm not sure that skewing the system clock has anything to do with the panic,
though.

The kernel image and the vmcore file are in my leaf account, ~y0netan1/crash

Cheers.