kernel ipfw rlock/wlock panic in stable/11

[Eugene Grosbein]

Hi!

My 11.0-STABLE/i386 r311924 debugging kernel catches _rm_assert(rm, RA_RLOCKED, file, line)
in sys/netpfil/ipfw:ipfw_chk() function trying to do IPFW_PF_RUNLOCK(chain) on an object
that was not rlocked but wlocked:

#17 0xc06b0255 in _rm_runlock_debug (rm=0xc0bce37c, file=<value optimized out>, line=<value optimized out>) at /home/src/sys/kern/kern_rmlock.c:690
690             _rm_assert(rm, RA_RLOCKED, file, line);
(kgdb) p rm
$1 = (struct rmlock *) 0xc0bce37c
(kgdb) p *rm
$2 = {lock_object = {lo_name = 0xc0a802a2 "IPFW static rules", lo_flags = 50528256, lo_data = 0, lo_witness = 0xc50c6a20}, rm_writecpus = {
    __bits = 0xc0bce38c}, rm_activeReaders = {lh_first = 0x0}, _rm_lock = {_rm_wlock_object = {lo_name = 0xc0a802a2 "IPFW static rules", lo_flags = 16842752, 
      lo_data = 0, lo_witness = 0x0}, _rm_lock_mtx = {lock_object = {lo_name = 0xc0a802a2 "IPFW static rules", lo_flags = 16842752, lo_data = 0, 
        lo_witness = 0x0}, mtx_lock = 4}, _rm_lock_sx = {lock_object = {lo_name = 0xc0a802a2 "IPFW static rules", lo_flags = 16842752, lo_data = 0, 
        lo_witness = 0x0}, sx_lock = 4}}}

Full kgdb script here: http://www.grosbein.net/freebsd/crash/20170114/kgdb.log
There are vmcore, kernel.debug and crashinfo available in the same directory.

Is it ipfw bug of assertion bug?