6.1/amd64 panic in nat_inlookup()

[Edgar Fuß <ef%math.uni-bonn.de@localhost>]

We got the following panic on a 6.1_STABLE/amd64 server while restarting ipf:

fatal page fault in supervisor mode
trap type 6 code 0 rip ffffffff8023e7f4 cs 8 rflags 10212 cr2  ad0 cpl 4 rsp fffffe8001005970
kernel: page fault trap, code=0
Stopped in pid 0.3 (system) at  netbsd:nat_inlookup+0x95:        movq    0(%rax,%rdx,8),%rbx

db{0}> bt
nat_inlookup() at netbsd:nat_inlookup+0x95
fr_checknatin() at netbsd:fr_checknatin+0x119
fr_check() at netbsd:fr_check+0x3e3
fr_check_wrapper() at netbsd:fr_check_wrapper+0x84
pfil_run_hooks() at netbsd:pfil_run_hooks()+0x9d
ip_input() at netbsd:ip_input+0x68b
ipintr() at netbsd:ipintr+0x107
softint_dispatch() at netbsd:softint_dispatch+0x7b
DDB lost frame for netbsd:Xsoftintr+0x4f, trying 0xfffffe8001005d70
Xsoftintr() at netbsd:Xsoftintr+0x4f
--- interrupt ---
0:

db{0}> show registers
ds	0
es	0
fs	0
gs	7420
rdi	fffffe8001005ac0
rsi	11
rbp	fffffe80010059e0
rbx	f4bb1a68
rdx	15a
rcx	1
rax	0
r8	f4abc925
r9	11
r10	fffffe8001005ac0
r11	1600
r12	fffffe810795a008
r13	b784dc83
r14	f4abc925
r15	6
rip	ffffffff8023e7f4	nat_inlookup+0x95
cs	8
rflags	10212
rsp	fffffe8001005970
ss	10
netbsd:nat_inlookup+0x95:	movq	0(%rax,%rdx,8),%rbx

(All natural OCR) Any hints?