Check that in_pcbfree() is only called once for each PCB. If that assumption is violated, "bad things" could follow.
I believe such an assert would have detected some of the problems @jch was chasing in PR 203175 (see r307551). We also use it in our internal TCP development.