Panic on kldload/kldunload in/near callout

I am on 11.0-CURRENT FreeBSD 11.0-CURRENT #4 r286760M: Thu Sep 10
08:15:43 MST 2015

I get random (1 out of 10 tries) panics when I do:
# kldunload dummynet ; kldunload ipfw ;kldload ipfw ; kldload dummynet

I used to get panics on a couple months old -head also.

kernel trap 12 with interrupts disabled

Fatal trap 12: page fault while in kernel mode
cpuid = 0; apic id = 00
fault virtual address   = 0xffffffff8225cf58
fault code              = supervisor read data, page not present
instruction pointer     = 0x20:0xffffffff80aad500
stack pointer           = 0x28:0xfffffe1f9d588700
frame pointer           = 0x28:0xfffffe1f9d588790
code segment            = base 0x0, limit 0xfffff, type 0x1b
                        = DPL 0, pres 1, long 1, def32 0, gran 1

Following https://www.freebsd.org/doc/faq/advanced.html, I did:
# nm -n /boot/kernel/kernel | grep ffffffff80aad500
# nm -n /boot/kernel/kernel | grep ffffffff80aad50
# nm -n /boot/kernel/kernel | grep ffffffff80aad5
# nm -n /boot/kernel/kernel | grep ffffffff80aad
ffffffff80aad030 t itimers_event_hook_exec
ffffffff80aad040 t realtimer_expire
ffffffff80aad360 T callout_process
ffffffff80aad6b0 t softclock_call_cc
ffffffff80aadc10 T softclock
ffffffff80aadd20 T timeout
ffffffff80aade90 T callout_reset_sbt_on

So I guess " ffffffff80aad360 T callout_process" is the closest match?

I'll try to get real dump to get more information but that may take a
while. 

ccing jch and hans who've been playing in this area.

Cheers,
Hiren