r194546 amd64: kernel panic in tcp_sack.c

Hello, hope you're having a nice day,

I've been testing my system mostly to check if ZFS in -current is 
stable, however so far I've been getting kernel panics in every other 
area except ZFS. This time it's tcp_sack.c according to the panic 
message, inside [intr].

fujibayashi_at_ameagari ~ % uname -a
FreeBSD ameagari.fujibayashi.jp 8.0-CURRENT FreeBSD 8.0-CURRENT #1 
r194546: Thu Jun 25 19:44:18 JST 2009     
root_at_ameagari.fujibayashi.jp:/usr/src/sys/amd64/compile/Ameagari  amd64

panic: tcp_sack_globalholes >= 0
cpuid = 0
KDB: enter: panic
[thread pid 12 tid 100005]
Stopped at kdb_enter+0x3d: movq $0,0x682580(%rip)
db> bt
Tracing pid 12 tid 100005 td 0xffffff0001320000
kdb_enter() at kdb_enter+0x3d
panic() at panic+0x17b
tcp_sackhole_remove() at tcp_sackhole_remove+0xc7
tcp_free_sackholes() at tcp_free_sackholes+0x48
tcp_timer_rexmt() at tcp_timer_rexmt+0xb3
softclock() at softclock+0x291
intr_event_execute_handlers() at intr_event_execute_handlers+0x68
ithread_loop() at ithread_loop+0xb2
fork_exit() at fork_exit+0x12a
fork_trampoline() at fork_trampoline+0xe
--- trap 0, rip = 0, rsp = 0xffffff8000026d40, rbp = 0 ---
db >

No core saved - when I tried to get it to save the core, it just raised 
fatal trap 12 (page fault) and got a general protection fault afterwards.
Any ideas?

Kernel is GENERIC +
options         IPFILTER        # IPFilter
options         IPFILTER_LOG    # IPFilter logging
options         IPFIREWALL      # IPFW2
options         IPFIREWALL_DEFAULT_TO_ACCEPT
options         DUMMYNET        # IPFW Traffic Shaper
options         DEVICE_POLLING  # Polling support for NICs etc

with WITNESS disabled:

#options        WITNESS                 # Enable checks to detect 
deadlocks and cycles
#options        WITNESS_SKIPSPIN        # Don't run witness on spinlocks 
for speed

--
Kamigishi Rei
KREI-RIPE