Sounds/looks very similar similar to my kern/29787 where I could catch such a panic within a serial remote console in the meantime. My presumed wm driver relation could be pure random though it's still the only machine showing such panics. Setting net.inet.tcp{,6}.sack.enable=0 seems to avoid these panics.