Sounds/looks very similar similar to my

  kern/29787

where I could catch such a panic within a serial remote console in the
meantime.

My presumed wm driver relation could be pure random though it's still
the only machine showing such panics.

Setting net.inet.tcp{,6}.sack.enable=0 seems to avoid these panics.