panic: sleeping thread owns a non-sleepable lock

I'm running 7.0-CURRENT as of  yesterday, and it's very easy
to make it panic:

Sleeping thread (tid 100065, pid 1066) owns a non-sleepable lock
sched_switch(c50a1600,0,1,1c7a7e4,4217e5,...) at sched_switch+0x190
mi_switch(1,0) at mi_switch+0x13f
sleepq_switch(c50a1600,0,c078a4e2,21b,c07e3820,...) at sleepq_switch+0x87
sleepq_wait(c07e3820,0,c0770b7e,3,0,...) at sleepq_wait+0x36
_sx_xlock_hard(c07e3820,c50a1600,0,0,0,...) at _sx_xlock_hard+0x21d
fr_checknatout(f9c7a8d0,f9c7a8cc,64,c57ad900,c4de7400,...) at
fr_checknatout+0x29d
fr_check(c8cc4644,14,c4de7400,1,f9c7a9b4,...) at fr_check+0x9b1
fr_check_wrapper(0,f9c7a9b4,c4de7400,2,c54dab28,...) at fr_check_wrapper+0x3f
pfil_run_hooks(c08057c0,f9c7aa4c,c4de7400,2,c54dab28,...) at pfil_run_hooks+0x74
ip_output(c8cc4600,0,f9c7aa10,0,0,...) at ip_output+0x913
tcp_output(cae322d0,cb277200,0,0,0,...) at tcp_output+0x1106
tcp_usr_send(c51e7318,0,cb277200,0,0,...) at tcp_usr_send+0x240
kern_sendfile(c50a1600,f9c7acfc,0,0,0,...) at kern_sendfile+0x1037
sendfile(c50a1600,f9c7acfc,20,16,f9c7ad2c,...) at sendfile+0xa8
syscall(f9c7ad38) at syscall+0x315
Xint0x80_syscall() at Xint0x80_syscall+0x20
--- syscall (393, FreeBSD ELF32, sendfile), eip = 0x28290bff, esp =
0xbfbfc6ac, ebp = 0xbfbfe718 ---

This host have 3 jails, 2 with public ip and one with private ip.
I have ipfw + ipnat running.  ipfw has some port blocking rule
with ip written in either rule itself or in a table. I also have a rule
with src-limit. ipnat is to do NAT for that private ip jail. It also contains
a redirect rule for ssh in that jail. This panic is very easy to trigger
if I ssh to the jail with private ip and do something, like build ports.

Any ideas?

Regards,
Rong-En Fan