The crash can occur when all of the following conditions are true:
- a packet consists of multiple segements (requires LRO enabled)
- there has been a failure to allocate an mbuf for the packet and the packet has to be dropped
- a host (vmware) still owned at least one segment of the packet, so the driver had to wait for another interrupt to proceed to discarding the remaning segment(s)
The work was sponsored by Panzura who run into the problem.