rtwn(0) panics with RTL8188CE

Dear all,

thankfully -CURRENT supports the RTL8188CE wifi chipset via rtwn(0)
on the Thinkpad X230. Unfortunately the connection to the AP drops
nine times out of ten after transmitting a few kb. Trying to
reconnect via service netif restart will cause a panic:

panic: Memory modified after free 0xfffff80005c50800(2048) val=19 _at_ 0xfffff80005c50800

cpuid = 0
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 0xfffffe04552ae540
vpanic() at vpanic+0x186/frame 0xfffffe04552ae5c0
panic() at panic+0x43/frame 0xfffffe04552ae620
trash_ctor() at trash_ctor+0x4b/frame 0xfffffe04552ae630
mb_ctor_pack() at mb_ctor_pack+0x3c/frame 0xfffffe04552ae670
uma_zalloc_arg() at uma_zalloc_arg+0x504/frame 0xfffffe04552ae6d0
m_getm2() at m_getm2+0x12d/frame 0xfffffe04552ae740
m_uiotombuf() at m_uiotombuf+0x62/frame 0xfffffe04552ae790
sosend_generic() at sosend_generic+0x356/frame 0xfffffe04552ae850
kern_sendit() at kern_sendit+0x244/frame 0xfffffe04552ae900
sendit() at sendit+0x126/frame 0xfffffe04552ae950
sys_sendto() at sys_sendto+0x4d/frame 0xfffffe04552ae9a0
amd64_syscall() at amd64_syscall+0x2db/frame 0xfffffe04552aeab0
Xfast_syscall() at Xfast_syscall+0xfb/frame 0xfffffe04552aeab0
--- syscall (133, FreeBSD ELF64, sys_sendto), rip = 0x8015aac6a, rsp = 0x7fffffffd6a8, rbp = 0
x7fffffffe3b0 ---

pciconf -lv:
[...]
rtwn0_at_pci0:3:0:0:	class=0x028000 card=0x819510ec chip=0x817610ec rev=0x01 hdr=0x00
    vendor     = 'Realtek Semiconductor Co., Ltd.'
    device     = 'RTL8188CE 802.11b/g/n WiFi Adapter'
    class      = network

Any help on getting this fixed is highly appreciated. 

Cheers
Marcus