Panic/Freeze with IPSEC on r254532

I thought I'd have a play with ipsec since its been a while since I last
set it up, and was setting up a transport mode connection between my
poudiere/repo server (the -curent server) and another box (8.2-RELEASE)
3 pings later the -CURRENT box froze, its zfs on root so no kernel dump
I'm afraid, it does have an ipmi so I repeated with a serial over lan
connection to test but got nothing it just froze. Any suggestions?
The only unusual thing about this machine is that i am running a bhyve
vm on it. not sure how relevant that is.

Log output
1st occurance
Aug 20 13:24:51 bsdpkgbuild kernel: Kernel page fault with the following
non-sleepable locks held:
Aug 20 13:24:51 bsdpkgbuild kernel: shared rw ipsec request (ipsec
request) r = 0 (0xfffff80020fe2f60) locked _at_
/usr/src/sys/netipsec/ipsec_output.c:436
Aug 20 13:24:51 bsdpkgbuild kernel: shared rw rawinp (rawinp) r = 0
(0xfffff800587afda8) locked _at_ /usr/src/sys/netinet/raw_ip.c:446
Aug 20 13:24:51 bsdpkgbuild kernel: KDB: stack backtrace:
Aug 20 13:24:51 bsdpkgbuild kernel: db_trace_self_wrapper() at
db_trace_self_wrapper+0x2b/frame 0xfffffe0238af91e0
Aug 20 13:24:51 bsdpkgbuild kernel: kdb_backtrace() at
kdb_backtrace+0x39/frame 0xfffffe0238af9290
Aug 20 13:24:51 bsdpkgbuild kernel: witness_warn() at
witness_warn+0x4a8/frame 0xfffffe0238af9350
Aug 20 13:24:51 bsdpkgbuild kernel: trap_pfault() at
trap_pfault+0x5a/frame 0xfffffe0238af9400
Aug 20 13:24:51 bsdpkgbuild kernel: trap() at trap+0x670/frame
0xfffffe0238af9620
Aug 20 13:24:51 bsdpkgbuild kernel: calltrap() at calltrap+0x8/frame
0xfffffe0238af9620
Aug 20 13:24:51 bsdpkgbuild kernel: --- trap 0xc, rip =
0xffffffff80aa6a53, rsp = 0xfffffe0238af96e0, rbp = 0xfffffe0238af9770 ---
Aug 20 13:24:51 bsdpkgbuild kernel: ipsec4_process_packet() at
ipsec4_process_packet+0x73/frame 0xfffffe0238af9770
Aug 20 13:24:51 bsdpkgbuild kernel: ip_ipsec_output() at
ip_ipsec_output+0x197/frame 0xfffffe0238af97b0
Aug 20 13:24:51 bsdpkgbuild kernel: ip_output() at ip_output+0x8a3/frame
0xfffffe0238af98a0
Aug 20 13:24:51 bsdpkgbuild kernel: rip_output() at
rip_output+0x2fa/frame 0xfffffe0238af98f0
Aug 20 13:24:51 bsdpkgbuild kernel: sosend_generic() at
sosend_generic+0x3dc/frame 0xfffffe0238af99a0
Aug 20 13:24:51 bsdpkgbuild kernel: kern_sendit() at
kern_sendit+0x1e4/frame 0xfffffe0238af9a40
Aug 20 13:24:51 bsdpkgbuild kernel: sendit() at sendit+0xf8/frame
0xfffffe0238af9a90
Aug 20 13:24:51 bsdpkgbuild kernel: sys_sendto() at
sys_sendto+0x4d/frame 0xfffffe0238af9ae0
Aug 20 13:24:51 bsdpkgbuild kernel: amd64_syscall() at
amd64_syscall+0x265/frame 0xfffffe0238af9bf0
Aug 20 13:24:51 bsdpkgbuild kernel: Xfast_syscall() at
Xfast_syscall+0xfb/frame 0xfffffe0238af9bf0
Aug 20 13:24:51 bsdpkgbuild kernel: --- syscall (133, FreeBSD ELF64,
sys_sendto), rip = 0x800d5ccea, rsp = 0x7ffffffed578, rbp =
0x7ffffffed5b0 ---
Aug 20 13:24:51 bsdpkgbuild kernel:
Aug 20 13:24:51 bsdpkgbuild kernel:
Aug 20 13:24:51 bsdpkgbuild kernel: Fatal trap 12: page fault while in
kernel mode
Aug 20 13:24:51 bsdpkgbuild kernel: cpuid = 5; apic id = 02
Aug 20 13:24:51 bsdpkgbuild kernel: fault virtual address       = 0xd0
Aug 20 13:24:51 bsdpkgbuild kernel: fault code          = supervisor
write data, page not present
Aug 20 13:24:51 bsdpkgbuild kernel: instruction pointer =
0x20:0xffffffff80aa6a53
Aug 20 13:24:51 bsdpkgbuild kernel: stack pointer               =
0x28:0xfffffe0238af96e0
Aug 20 13:24:51 bsdpkgbuild kernel: frame pointer               =
0x28:0xfffffe0238af9770
Aug 20 13:24:51 bsdpkgbuild kernel: code segment                = base
0x0, limit 0xfffff, type 0x1b
Aug 20 13:24:51 bsdpkgbuild kernel: = DPL 0, pres 1, long 1, def32 0, gran 1
Aug 20 13:24:51 bsdpkgbuild kernel: processor eflags    = interrupt
enabled,
===
repeated occurrence
Aug 20 14:16:21 bsdpkgbuild kernel: Kernel page fault with the following
non-sleepable locks held:
Aug 20 14:16:21 bsdpkgbuild kernel: shared rw ipsec request (ipsec
request) r = 0 (0xfffff8001a9820e0) locked _at_
/usr/src/sys/netipsec/ipsec_output.c:436
Aug 20 14:16:21 bsdpkgbuild kernel: shared rw rawinp (rawinp) r = 0
(0xfffff801db519da8) locked _at_ /usr/src/sys/netinet/raw_ip.c:446
Aug 20 14:16:21 bsdpkgbuild kernel: KDB: stack backtrace:
Aug 20 14:16:21 bsdpkgbuild kernel: db_trace_self_wrapper() at
db_trace_self_wrapper+0x2b/frame 0xfffffe0238b081e0
Aug 20 14:16:21 bsdpkgbuild kernel: kdb_backtrace() at
kdb_backtrace+0x39/frame 0xfffffe0238b08290
Aug 20 14:16:21 bsdpkgbuild kernel: witness_warn() at
witness_warn+0x4a8/frame 0xfffffe0238b08350
Aug 20 14:16:21 bsdpkgbuild kernel: trap_pfault() at
trap_pfault+0x5a/frame 0xfffffe0238b08400
Aug 20 14:16:21 bsdpkgbuild kernel: trap() at trap+0x670/frame
0xfffffe0238b08620
Aug 20 14:16:21 bsdpkgbuild kernel: calltrap() at calltrap+0x8/frame
0xfffffe0238b08620
Aug 20 14:16:21 bsdpkgbuild kernel: --- trap 0xc, rip =
0xffffffff80aa6a53, rsp = 0xfffffe0238b086e0, rbp = 0xfffffe0238b08770 ---
Aug 20 14:16:21 bsdpkgbuild kernel: ipsec4_process_packet() at
ipsec4_process_packet+0x73/frame 0xfffffe0238b08770
Aug 20 14:16:21 bsdpkgbuild kernel: ip_ipsec_output() at
ip_ipsec_output+0x197/frame 0xfffffe0238b087b0
Aug 20 14:16:21 bsdpkgbuild kernel: ip_output() at ip_output+0x8a3/frame
0xfffffe0238b088a0
Aug 20 14:16:21 bsdpkgbuild kernel: rip_output() at
rip_output+0x2fa/frame 0xfffffe0238b088f0
Aug 20 14:16:21 bsdpkgbuild kernel: sosend_generic() at
sosend_generic+0x3dc/frame 0xfffffe0238b089a0
Aug 20 14:16:21 bsdpkgbuild kernel: kern_sendit() at
kern_sendit+0x1e4/frame 0xfffffe0238b08a40
Aug 20 14:16:21 bsdpkgbuild kernel: sendit() at sendit+0xf8/fra
Aug 20 14:16:21 bsdpkgbuild kernel: m
Aug 20 14:16:21 bsdpkgbuild kernel: e 0xfffffe
Aug 20 14:16:21 bsdpkgbuild kernel: 0
Aug 20 14:16:21 bsdpkgbuild kernel: 23
Aug 20 14:16:21 bsdpkgbuild kernel: 8
Aug 20 14:16:21 bsdpkgbuild kernel: b
Aug 20 14:16:21 bsdpkgbuild kernel: 08a9
Aug 20 14:16:21 bsdpkgbuild kernel: 0


Cheers,
Vince