DragonFlyBSD

Another panic out of the blue, this time in the wireless stack.
Version String: DragonFly v3.1.0.704.gee39c-DEVELOPMENT

panic: Bad link elm 0xffffffe07edf6068 next->prev != elm
cpuid = 1
Trace beginning at frame 0xffffffe07eca3ac0
panic() at panic+0x1fb 0xffffffff802fa6e8
panic() at panic+0x1fb 0xffffffff802fa6e8
_ieee80211_free_node() at _ieee80211_free_node+0x76 0xffffffff803c598f
ieee80211_free_node() at ieee80211_free_node+0x3c 0xffffffff803c5d9a
rt2661_reset_tx_ring() at rt2661_reset_tx_ring+0x87 0xffffffff802b13a4
rt2661_stop_locked() at rt2661_stop_locked+0x232 0xffffffff802b2261
rt2661_ioctl() at rt2661_ioctl+0x7f 0xffffffff802b46a4
parent_updown_task() at parent_updown_task+0x3f 0xffffffff803cf007
taskqueue_run() at taskqueue_run+0xc2 0xffffffff8032a16f
taskqueue_thread_loop() at taskqueue_thread_loop+0x5e 0xffffffff8032a4e5
boot() called on cpu#1

The dump is available on leaf.