GPF in ether_output -> m_tag_locate

On an 8-core amd64 running up-to-date CVS sources:

> Fatal trap 9: general protection fault while in kernel mode
> cpuid = 7; apic id = 07
> instruction pointer     = 0x8:0xffffffff802a7800
> stack pointer           = 0x10:0xffffffffabc61960
> frame pointer           = 0x10:0xffffffffabc61970
> code segment            = base 0x0, limit 0xfffff, type 0x1b
>                         = DPL 0, pres 1, long 1, def32 0, gran 1
> processor eflags        = interrupt enabled, resume, IOPL = 0
> current process         = 19 (swi4: clock sio)
> Tracing pid 19 tid 100005 td 0xffffff00b9a7f000
> m_tag_locate() at m_tag_locate+0x20
> ether_output() at ether_output+0x2ec
> ip_output() at ip_output+0x9b5
> udp_output() at udp_output+0x594
> udp_send() at udp_send+0x1c
> nfs_timer() at nfs_timer+0x7de
> softclock() at softclock+0x319
> ithread_execute_handlers() at ithread_execute_handlers+0x15d
> ithread_loop() at ithread_loop+0x69
> fork_exit() at fork_exit+0x93
> fork_trampoline() at fork_trampoline+0xe
> --- trap 0, rip = 0, rsp = 0xffffffffabc61d30, rbp = 0 ---

Kris