panic possibly on on bridge member removal

After a few hours of operation involving tap0 added to the bridge
running openvpn
and shutting down openvpn which removes tap0 from the bridge, the
machine is found to have a panic:

Fatal trap 12: page fault while in kernel mode
cpuid = 1; apic id = 01
fault virtual address   = 0x188
fault code              = supervisor read data, page not present
instruction pointer     = 0x20:0xffffffff82a14f96
stack pointer           = 0x28:0xffffff8000285670
frame pointer           = 0x28:0xffffff80002856b0
code segment            = base 0x0, limit 0xfffff, type 0x1b
                        = DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags        = interrupt enabled, resume, IOPL = 0
current process         = 12 (swi5: fast taskq)
[ thread pid 12 tid 100022 ]
Stopped at      bridge_enqueue+0x86:    calll   *0x188(%r12)
db> bt
Tracing pid 12 tid 100022 td 0xfffffe0003aff000
bridge_enqueue() at bridge_enqueue+0x86
ether_output() at ether_output+0x580
ip_output() at ip_output+0xb2e
ip_forward() at ip_forward+0x1e5
ip_input() at ip_input+0x54e
netisr_dispatch_src() at netisr_dispatch_src+0x7b
ether_demux() at ether_demux+0x156
ether_nh_input() at ether_nh_input+0x31a
netisr_dispatch_src() at netisr_dispatch_src+0x7b
re_rxeof() at re_rxeof+0x515
re_int_task() at re_int_task+0x8b
taskqueue_run_locked() at taskqueue_run_locked+0xf0
taskqueue_run() at taskqueue_run+0x4a
intr_event_execute_handlers() at intr_event_execute_handlers+0xaa
ithread_loop() at ithread_loop+0xde
fork_exit() at fork_exit+0x80
fork_trampoline() at fork_trampoline+0xe
--- trap 0, rip = 0, rsp = 0xffffff8000285cb0, rbp = 0 ---

Trying to get a dump results in a hang:

db> call doadump
Dumping 762 out of 4055 MB:  (hang)

thanks
-kim