MPSAFE fxp m_pkthdr not valid

I have gotten fxp running with MPSAFE and did a large scp transfer.  It
ran for a few minutes and then paniced.  It was trap 12 (page fault) at
address 0x24.  Here is where it crashed:

fxp_start+0xcc
0xc0194a4c is in fxp_start (../../../dev/fxp/if_fxp.c:1263).
1258                     * been computed and stored in the checksum field
1259                     * in the TCP header. The stack should have
1260                     * already done this for us.
1261                     */
1262    
1263                    if (mb_head->m_pkthdr.csum_flags) {
1264                            if (mb_head->m_pkthdr.csum_flags & CSUM_DELAY_DATA) {
1265                                    txp->tx_cb->ipcb_ip_activation_high =
1266                                       FXP_IPCB_HARDWAREPARSING_ENABLE;
1267                                    txp->tx_cb->ipcb_ip_schedule =

The deref of mb_head->m_pkthdr is invalid.  Note that my fxp_intr function
acquires the fxp lock right away so this shouldn't be a race in fxp.

There is still the slab_zalloc LOR which I will describe further in another
email.

-Nate