Panic in prison_alloc() on boot

I'm getting a persistent panic on boot in prison_allow().  The first
case that I hit is this:

Fatal trap 12: page fault while in kernel mode
cpuid = 10; apic id = 22
fault virtual address   = 0x30
fault code              = supervisor read data, page not present
instruction pointer     = 0x20:0xffffffff80ab9674
stack pointer           = 0x28:0xfffffe00f8bb16f0
frame pointer           = 0x28:0xfffffe00f8bb16f0
code segment            = base 0x0, limit 0xfffff, type 0x1b
                        = DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags        = interrupt enabled, resume, IOPL = 0
current process         = 90 (mount_nullfs)
[ thread pid 90 tid 100913 ]
Stopped at      prison_allow+0x4:       movq    ll+0xf(%rdi),%rax
db> bt
Tracing pid 90 tid 100913 td 0xfffff801a5aab000
prison_allow() at prison_allow+0x4/frame 0xfffffe00f8bb16f0
nullfs_mount() at nullfs_mount+0x31/frame 0xfffffe00f8bb1830
vfs_donmount() at vfs_donmount+0x1415/frame 0xfffffe00f8bb1a80
sys_nmount() at sys_nmount+0x72/frame 0xfffffe00f8bb1ac0
amd64_syscall() at amd64_syscall+0xa48/frame 0xfffffe00f8bb1bf0
fast_syscall_common() at fast_syscall_common+0x101/frame 0x7fffffffecb0

However if I comment out my nullfs mounts in /etc/fstab, I just get a
panic in prison_allow() called from elsewhere.

I've seen this panic with r328936 (Feb 6), r329091 (Feb 9) and r329142 (Feb 11)