panic: Duplicate free of item 0xc2580a00 from zone 0xc103e9a0(Mbuf)

With GENERIC HEAD from Feb 23 06:23 UTC + mpsafe_vfs = 1 I got:

Slab at 0xc2580fa8, freei 10 = 0.
panic: Duplicate free of item 0xc2580a00 from zone 0xc103e9a0(Mbuf)

cpuid = 0
KDB: enter: panic
[thread pid 37 tid 100013 ]
Stopped at      kdb_enter+0x2b: nop
db> where
Tracing pid 37 tid 100013 td 0xc1524450
kdb_enter(c0824c5d) at kdb_enter+0x2b
panic(c083ea9c,c2580a00,c103e9a0,c0823405,c083ea80) at panic+0x14b
uma_dbg_free(c103e9a0,0,c2580a00) at uma_dbg_free+0x110
uma_zfree_arg(c103e9a0,c2580a00,0) at uma_zfree_arg+0xf3
m_freem(c2580a00,5ea,3,c15fc8fc,0) at m_freem+0x36
m_defrag(c2580a00,1,c15fcf00,1,c08384bf,579) at m_defrag+0x18a
rl_encap(c15fc800,c2580a00) at rl_encap+0x2b
rl_start_locked(c15fc800,c15fcf00,0,c08384bf,5a4) at rl_start_locked+0x1f3
rl_start(c15fc800) at rl_start+0x28
if_start(c15fc800) at if_start+0x7b
ether_output_frame(c15fc800,c2580a00,0,0,0) at ether_output_frame+0x1d9
ether_output(c15fc800,c2580a00,c2467500,c180c7bc,c2264c58) at ether_output+0x380
in_arpinput(c2264c00,c2264c00,cbf9bce0,c067eef6,c2264c00) at in_arpinput+0x5a6
arpintr(c2264c00) at arpintr+0xca
netisr_processqueue(c0951978) at netisr_processqueue+0x6e
swi_net(0) at swi_net+0xbe
ithread_loop(c154f080,cbf9bd48,c154f080,c05fe964,0) at ithread_loop+0x120
fork_exit(c05fe964,c154f080,cbf9bd48) at fork_exit+0xa4
fork_trampoline() at fork_trampoline+0x8
--- trap 0x1, eip = 0, esp = 0xcbf9bd7c, ebp = 0 ---

Details at http://www.holm.cc/stress/log/cons119.html
-- 
Peter Holm