panic: negative refcount after dhclient during boot

Hi all,

On my FreeBSD/mips machine (it's a RouterStation Pro), I get the
following panic during boot:

FreeBSD is a registered trademark of The FreeBSD Foundation.
FreeBSD 11.0-CURRENT #0 r285099: Sun Jul  5 12:31:47 CEST 2015
    rink_at_greed.home.rink.nu:/home/rink/freebsd/obj/mips.mips/home/rink/freebsd/head/sys/FRINGE mips
gcc version 4.2.1 20070831 patched [FreeBSD]
[...]
Starting devd.
Additional inet routing options: gateway=YES.
Starting dhclient.
DHCPREQUEST on arge0 to 255.255.255.255 port 67
panic: negative refcount 0x8087ec24
KDB: enter: panic
[ thread pid 11 tid 100027 ]
Stopped at      kdb_enter+0x4c: lui     at,0x8066
db> r
?
KDB: reentering
KDB: stack backtrace:
db_trace_thread+30 (?,?,?,?) ra cc72b51800000018 sp 0 sz 0
db_trace_self+1c (?,?,?,?) ra cc72b53000000018 sp 0 sz 0
80086f30+34 (?,?,?,?) ra cc72b548000001a0 sp 0 sz 0
kdb_backtrace+44 (?,?,?,?) ra cc72b6e800000018 sp 0 sz 0
kdb_reenter+3c (?,?,?,?) ra cc72b70000000018 sp 0 sz 0
db_error+30 (?,?,?,?) ra cc72b71800000018 sp 0 sz 0
db_run_cmd+28 (?,?,?,?) ra cc72b73000000018 sp 0 sz 0
80084204+388 (?,?,?,?) ra cc72b748000000a8 sp 0 sz 0
db_command_loop+70 (?,?,?,?) ra cc72b7f000000018 sp 0 sz 0
80086dc8+f4 (?,?,?,?) ra cc72b808000001a8 sp 0 sz 0
kdb_trap+110 (?,?,?,?) ra cc72b9b000000030 sp 0 sz 0
trap+cfc (?,?,?,?) ra cc72b9e0000000c8 sp 0 sz 0
MipsKernGenException+134 (0,4,80560720,12f) ra cc72baa8000000c8 sp
100000001 sz 1
kdb_enter+4c (?,?,?,?) ra cc72bb7000000018 sp 0 sz 0
vpanic+ec (?,?,?,?) ra cc72bb8800000020 sp 0 sz 0
kassert_panic+78 (?,8087ec24,80c7b470,0) ra cc72bba800000020 sp 1 sz 1
ifa_free+40 (?,?,?,?) ra cc72bbc800000018 sp 0 sz 0
ip_forward+838 (?,?,?,?) ra cc72bbe000000068 sp 0 sz 0
ip_input+ce4 (823baa00,?,?,?) ra cc72bc4800000038 sp 100000000 sz 0
netisr_dispatch_src+134 (?,?,?,?) ra cc72bc8000000040 sp 0 sz 0
netisr_dispatch+14 (?,?,?,?) ra cc72bcc000000018 sp 0 sz 0
ether_demux+254 (?,823baa00,?,?) ra cc72bcd800000028 sp 1 sz 0
80333ffc+530 (823baa00,?,?,?) ra cc72bd0000000030 sp 100000000 sz 0
netisr_dispatch_src+134 (?,?,?,?) ra cc72bd3000000040 sp 0 sz 0
netisr_dispatch+14 (?,?,?,?) ra cc72bd7000000018 sp 0 sz 0
80333b58+54 (?,?,?,?) ra cc72bd8800000020 sp 0 sz 0
804c7948+30c (?,?,?,?) ra cc72bda800000048 sp 0 sz 0
intr_event_execute_handlers+13c (?,?,?,?) ra cc72bdf000000028 sp 0 sz 0
80228a80+c8 (?,?,?,?) ra cc72be1800000040 sp 0 sz 0
fork_exit+b0 (?,?,?,?) ra cc72be5800000028 sp 0 sz 0
fork_trampoline+10 (?,?,?,?) ra cc72be8000000000 sp 0 sz 0
pid 11
db>    

This reproduces 100%. I'm at:

FreeBSD 11.0-CURRENT #0 r285099: Sun Jul  5 12:31:47 CEST 2015

Let me know what I can do to help track this down; I only started
getting the panic after 'gateway_enable=YES' in /etc/rc.conf

The kernel has INVARIANTS but no WITNESS. Config available at
http://rink.nu/tmp/FRINGE - boot log at http://rink.nu/tmp/fringe.txt

Regards,
Rink Springer