sbflush_locked panic and tcp_sack

Hi,

I got a panic at the end of sbflush_locked() on recent -current when
open a large photo gallery with firefox.

if (sb->sb_cc || sb->sb_mb || sb->sb_mbcnt)
                panic("sbflush_locked: cc %u || mb %p || mbcnt %u", sb->sb_cc,
			(void *)sb->sb_mb, sb->sb_mbcnt);

It seems I can reproduce this panic easily.  Moreover, turning
tcp_sack off eliminates this panic.  Does anybody see that?

http://maxim.int.ru/stuff/panic/SONNIE
http://maxim.int.ru/stuff/panic/kgdb.typescript
http://maxim.int.ru/stuff/panic/sysctl-a

-- 
Maxim Konovalov