page fault in fr_makefrip

[Edgar Fuß <ef%math.uni-bonn.de@localhost>]

On our gateway running 4.0.1/amd64, we yesterday hit (manual OCR):

kernel: page fault trap, code=0
Stopped at	netbsd:fr_makefrip+0x13d:	cmpl	0x20(%rax),%edx
db> bt
fr_makefrip() at netbsd:fr_makefrip+0x13d
fr_checkicmp6matchingstate() at fr_checkicmp6matchingstatd+0xe3
fr_stlookup() at netbsd:fr_stlookup+0x684
fr_checkstate() at netbsd:fr_checkstate+0x44c
fr_check() at netbsd:fr_check+0x73e
pfil_run_hooks() at netbsd:pfil_run_hooks+0xa0
ip6_input() at netbsd:ip6_input+0x3d0
ip6intr() at netbsd:ip6intr+0x42
DDB lost frame for netbsd:Xsoftnet+0x58, trying 0xffffffff806aed10
Xsoftnet() at netbsd:Xsoftnet+0x58
--- interrupt ---
0x246:
db> show reg
ds	0x7400
es	0x8402
fs	0x4
gs	0xbef7
rdi	0
rsi	0xffff80004cb6707a
rbp	0xffffffff806ae7b0	_prop_dictionary_keysym32_pool+0x8fc50
rbx	0x6a00
rdx	0x9228
rcx	0
rax	0
r8	0x38060120
r9	0x10
r10	0xffffffff806aeb10	_prop_dictionary_keysym32_pool+0x8ffb0
r11	0xffffffff806ae7c0	_prop_dictionary_keysym32_pool+0x8fc60
r12	0x3a
r13	0xffffffff806ae7c0	_prop_dictionary_keysym32_pool+0x8fc60
r14	0xffffffff806ae7c8	_prop_dictionary_keysym32_pool+0x8fc68
r15	0x1
rip	0xffffffff80143c9d	ft_makefrip+0x13d
cd	0x8
rflags	0x10206
rsp	0xffffffff806ae780	_prop_dictionary_keysym32_pool+0x8f2c0
ss	0x10
netbsd:fr_makefrip+0x13d:	cmpl	0x20(%rax),%edx
db> reboot

any ideas?