panic on kldunload ipfw.ko

Easy to reproduce -- boot single user.  kldload ipfw.ko; kldunload 
ipfw.ko.  Next timeout, you get the following panic:

panic: write, page not present
callout_reset() + 0x12c
tcp_isn_tick() + 0x3f
softclock
ithread_loop

(gdb) l *callout_reset+0x12c
0xc05011e8 is in callout_reset (../../../kern/kern_timeout.c:437).
432
433             c->c_arg = arg;
434             c->c_flags |= (CALLOUT_ACTIVE | CALLOUT_PENDING);
435             c->c_func = ftn;
436             c->c_time = ticks + to_ticks;
437             TAILQ_INSERT_TAIL(&callwheel[c->c_time & callwheelmask],
438                               c, c_links.tqe);
439             mtx_unlock_spin(&callout_lock);
440     }
441

(gdb) l *tcp_isn_tick+0x3f
0xc0588c4f is in tcp_isn_tick (../../../netinet/tcp_subr.c:1368).
1363            if (projected_offset > isn_offset)
1364                    isn_offset = projected_offset;
1365
1366            isn_offset_old = isn_offset;
1367            callout_reset(&isn_callout, 1, tcp_isn_tick, NULL);
1368    }
1369
1370    /*
1371     * When a source quench is received, close congestion window
1372     * to one segment.  We will gradually open it again as we proceed.

-Nate