-net or kernel: where does this belong?

Posted on -questions but got no response, trying -current and -stable as 
well. Sorry for the cross-post but I'm getting kind of desperate...

Hi all,

Since quite a while I have had problems with {CURRENT|RELENG_7} SMP
machines that lock up when accessed from a remote location over a vpn
(ipsec) link and sees a ICMP_REDIRECT.

A message, "kernel: rtfree: <hex adress> has 1 refs, will be present in
logs.

Stefan Lambrev opened a PR
http://www.freebsd.org/cgi/query-pr.cgi?pr=117913
that I thought dealt with this but not sure if this maybe just touches
the messages, not lockups.

Later, I opened another PR
http://www.freebsd.org/cgi/query-pr.cgi?pr=118044
and so far there is absolute silence. See below for the (what I believe)
interesting part.

Question 1: Am I the only one on the planet that sees this problem?
Question 2: Could someone with some knowledge please tell if this is
a real bug or just something I cooked up myself?

Thanks a lot!

--per

Tracing command irq21: bge0 pid 33 tid 100025 td 0xc5119880
cpustop_handler(1,e3ccf958,c0a05b10,1,0,...) at cpustop_handler+0x32
ipi_nmi_handler(1,0,0,0,13,...) at ipi_nmi_handler+0x2f
trap(e3ccf964) at trap+0x30
calltrap() at calltrap+0x6
--- trap 0x13, eip = 0xc074e586, esp = 0xe3ccf9a4, ebp = 0xe3ccf9c8 ---
panic(c0a9b762,c5117660,c0aa0a06,c5117660,186ae,...) at panic+0x26
_mtx_lock_spin_failed(1,19,c0aa0a32,cb,19,...) at _mtx_lock_spin_failed+0x51
_thread_lock_flags(c57c6440,10,c0aa0a32,cb,1,...) at _thread_lock_flags+0xc7
propagate_priority(c0bbceec,0,c0aa0a32,2e2,c50f2a00,...) at
propagate_priority+0xe0
turnstile_wait(c50f2a00,c57c6440,0,17a,c5874678,...) at turnstile_wait+0x48c
_mtx_lock_sleep(c5874678,c5119880,0,c0aaa355,41c,...) at
_mtx_lock_sleep+0x15a
_mtx_lock_flags(c5874678,0,c0aaa355,41c,e3ccfaf4,...) at
_mtx_lock_flags+0xef
rt_setgate(c5874618,cb4ee2c0,e3ccfbac,c5119880,e3ccfb18,...) at
rt_setgate+0x196
rtredirect(e3ccfbbc,e3ccfbac,0,26,e3ccfb9c,...) at rtredirect+0x18e
icmp_input(c6fb6500,14,246,c0b9c7c0,e3ccfc0c,...) at icmp_input+0x50f
ip_input(c6fb6500,14e,800,c526a400,800,...) at ip_input+0x650
netisr_dispatch(2,c6fb6500,10,3,0,...) at netisr_dispatch+0x73
ether_demux(c526a400,c6fb6500,3,0,3,...) at ether_demux+0x1f1
ether_input(c526a400,c6fb6500,c0a6af05,bc4,c526a400,...) at
ether_input+0x37f
bge_intr(c526d000,0,c0a99497,471,c515e564,...) at bge_intr+0x7da
ithread_loop(c5271160,e3ccfd38,c0a9920b,2ea,c52512a8,...) at
ithread_loop+0x1b5
fork_exit(c0732ea0,c5271160,e3ccfd38) at fork_exit+0xb8
fork_trampoline() at fork_trampoline+0x8
--- trap 0, eip = 0, esp = 0xe3ccfd70, ebp = 0 ---