panic from ifconfig in IFAREF

I got this panic on HEAD when trying to configure an IP address on an 
interface immediately after boot:

 > Fatal trap 9: general protection fault while in kernel mode
 > ccpuid = 4; xapic id = 04
 > ginstruction pointer    = 0x8:0xffffffff80494b42
 > bstack pointer          = 0x10:0xffffffff20938490
 > 0frame pointe:r         = 0x10:0xffffffff20938610
 >  code segment           = base 0x0, limit 0xfffff, type 0x1b
 > link state changed to DOWN
 >                         = DPL 0, pres 1, long 1, def32 0, gran 1
 > processor eflags        = interrupt enabled, resume, IOPL = 0
 > current process         = 1073 (ifconfig)
 > [thread pid 1073 tid 100250 ]
 > Stopped at      strlen+0x2:     cmpb    $0,(%rdi)
 > db> wh
 > Tracing pid 1073 tid 100250 td 0xffffff00077ab720
 > strlen() at strlen+0x2
 > vsnprintf() at vsnprintf+0x2e
 > panic() at panic+0x1d8
 > _mtx_lock_flags() at _mtx_lock_flags+0xd9
 > rtrequest1_fib() at rtrequest1_fib+0x3e6
 > rtinit() at rtinit+0x213
 > in_ifinit() at in_ifinit+0x2bd
 > in_control() at in_control+0xe95
 > ifioctl() at ifioctl+0xfa
 > kern_ioctl() at kern_ioctl+0x92
 > ioctl() at ioctl+0xfd
 > syscall() at syscall+0x1bc
 > Xfast_syscall() at Xfast_syscall+0xab
 > --- syscall (54, FreeBSD ELF64, ioctl), rip = 0x140a69dfc, rsp = 
0x7fffffffe588, rbp = 0x7fffffffef7c ---
 > __func__.6541+0xfcb:    mtx_lock() of spin mutex %s _at_ %s:%d

The panic is here:

                 /*
                  * Note that we now have a reference to the ifa.
                  * This moved from below so that rnh->rnh_addaddr() can
                  * examine the ifa and  ifa->ifa_ifp if it so desires.
                  */
                 IFAREF(ifa);

(net/route.c:1081)

Kris