ipf -D panic with 5.0_RC1 amd64 domU

[Stephen Borrill <netbsd%precedence.co.uk@localhost>]

I've got a 5.0_RC1 amd64 domU running on Xen 3.3.1/5.0_RC1 amd64 dom0.
The domU is a fresh install. I logged in as root and typed ipf -D:

panic: kernel diagnostic assertion "c->c_magic == CALLOUT_MAGIC" failed: 
file "/usr/src/5.0/sys/kern/kern_timeout.c", line 424
fatal breakpoint trap in supervisor mode
trap type 1 code 0 rip ffffffff803765a5 cs e030 rflags 246 cr2 
7f7ffd93bda0 cpl 4 rsp ffffa000249424c0
Stopped in pid 281.1 (ipf) at   netbsd:breakpoint+0x5:  leave
breakpoint() at netbsd:breakpoint+0x5
panic() at netbsd:panic+0x255
__kernassert() at netbsd:__kernassert+0x2d
callout_stop() at netbsd:callout_stop+0xb4
ipfdetach() at netbsd:ipfdetach+0x57
fr_ipf_ioctl() at netbsd:fr_ipf_ioctl+0x46b
iplioctl() at netbsd:iplioctl+0xda
VOP_IOCTL() at netbsd:VOP_IOCTL+0x31
vn_ioctl() at netbsd:vn_ioctl+0x6d
sys_ioctl() at netbsd:sys_ioctl+0x134
syscall() at netbsd:syscall+0xb4
ds          0x24d0
es          0xe02b
fs          0x2480
gs          0x203
rdi         0
rsi         0xd
rbp         0xffffa000249424c0
rbx         0xffffa000249424d0
rdx         0
rcx         0
rax         0x1
r8          0xffffffff80591200  cpu_info_primary
r9          0x1
r10         0xffffa000249423e0
r11         0xffffffff8038e610  xenconscn_putc
r12         0x100
r13         0xffffffff80481ce0  copyright+0x8d360
r14         0x4
r15         0xffffa0002488a3e0
rip         0xffffffff803765a5  breakpoint+0x5
cs          0xe030
rflags      0x246
rsp         0xffffa000249424c0
ss          0xe02b
netbsd:breakpoint+0x5:  leave

Seems to be completely recreateable.

xennet0 is backed by a bridge to a vlan if that's of any consequence 
(which I can't get working. If I ping I see arp who-has and arp replies on 
the destination, but the arp replies never hit the wire).

--
Stephen