IPv6+dummynet causing panic on 6.2-RELEASE

[Peter Losher]

We have been having rampant issues using Dummynet's IPv6 support, and
it's been causing panic's every 24-48 hours.

Enabled WITNESS and BREAK_TO_DEBUGGER, and this is the result.

-=-
lock order reversal: (sleepable after non-sleepable)
 1st 0xffffff034809c900 rtentry (rtentry) @
/usr/src/sys/netinet6/ip6_input.c:501
 2nd 0xffffffff808dda70 user map (user map) @ /usr/src/sys/vm/vm_map.c:3074
KDB: stack backtrace:
witness_checkorder() at witness_checkorder+0x48a
_sx_xlock() at _sx_xlock+0x3e
vm_map_lookup() at vm_map_lookup+0x44
vm_fault() at vm_fault+0xba
trap_pfault() at trap_pfault+0x13c
trap() at trap+0x1bd
calltrap() at calltrap+0x5
--- trap 0xc, rip = 0xffffffff804c41f7, rsp = 0xffffffffbdf0da60, rbp =
0xffffffffbdf0daf0 ---
ip6_input() at ip6_input+0xa07
dummynet_send() at dummynet_send+0x17e
dummynet() at dummynet+0x21a
softclock() at softclock+0x19a
ithread_loop() at ithread_loop+0x132
fork_exit() at fork_exit+0x87
fork_trampoline() at fork_trampoline+0xe
--- trap 0, rip = 0, rsp = 0xffffffffbdf0dd00, rbp = 0 ---

Fatal trap 12: page fault while in kernel mode
cpuid = 2; apic id = 06
fault virtual address   = 0x98
fault code              = supervisor read, page not present
instruction pointer     = 0x8:0xffffffff804c41f7
stack pointer           = 0x10:0xffffffffbdf0da60
frame pointer           = 0x10:0xffffffffbdf0daf0
code segment            = base 0x0, limit 0xfffff, type 0x1b
                        = DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags        = interrupt enabled, resume, IOPL = 0
current process         = 15 (swi4: clock sio)
[thread pid 15 tid 100009 ]
Stopped at      ip6_input+0xa07:        movq    0x98(%rdi),%rax
db> tr
Tracing pid 15 tid 100009 td 0xffffff040ff3b000
ip6_input() at ip6_input+0xa07
dummynet_send() at dummynet_send+0x17e
dummynet() at dummynet+0x21a
softclock() at softclock+0x19a
ithread_loop() at ithread_loop+0x132
fork_exit() at fork_exit+0x87
fork_trampoline() at fork_trampoline+0xe
--- trap 0, rip = 0, rsp = 0xffffffffbdf0dd00, rbp = 0 ---
-=-

Any ideas how to proceed?

Best Wishes - Peter