Currently, the following steps will lead to an uma panic:
kldload if_bridge ifconfig bridge0 create ifconfig bridge0 addm wlan0 addm em0 up dhclient em0 kldunload if_bridge
Because bridge_rtnode_zone has outstanding allocations at the time of destruction.
Fix this by explicitly destroying the bridge interfaces at UNINIT. I chose to (attempt) to virtualize the uma zone these allocations come from to simplify things -- trying to reason through how best to destroy the uma zone once all of the bridges were cleaned up across all of the vnets gave me a bit of a headache. I am not completely sure how successful I was, but it looked at a glance like all of the bridge_rt* functions are called in a proper vnet context such that I didn't need to CURVNET_SET (ioctl handlers, IIRC).
Additionally, bridge_rtable_fini now flushes out the routing table to free the memory referenced in the initial panic.