It appears there's no enough room for the two new added counter tcps_sc_spurcookie and tcps_sc_failcookie, hence old version ( 14.4-RELEASE ) netstat -sp tcp will fail when talking to current/16 ( test only with current/16, shall also fail on stable/15 ).

% netstat -sp tcp
netstat: sysctl net.inet.tcp.stats: Cannot allocate memory

A dtrace script to capture,

#!/usr/sbin/dtrace -ws

syscall::__sysctlbyname:entry
/execname == "netstat"/
{
	self->trace = 1;
}

syscall::__sysctlbyname:return
/self->trace/
{
	self->trace = 0;
}

fbt:::return
/self->trace && (int)arg1 == ENOMEM/
{
	stack();
}

# ./sysctlbyname.d
dtrace: script './sysctlbyname.d' matched 40018 probes
dtrace: allowing destructive actions
CPU     ID                    FUNCTION:NAME
  2  18318           sysctl_old_user:return 
              kernel`tcpstat_sysctl+0x93
              kernel`sysctl_root_handler_locked+0x9c
              kernel`sysctl_root+0x22f
              kernel`userland_sysctl+0x1b6
              kernel`kern___sysctlbyname+0x226
              kernel`sys___sysctlbyname+0x2d
              kernel`amd64_syscall+0x451
              kernel`0xffffffff8110146b

  2  22931            tcpstat_sysctl:return 
              kernel`sysctl_root_handler_locked+0x9c
              kernel`sysctl_root+0x22f
              kernel`userland_sysctl+0x1b6
              kernel`kern___sysctlbyname+0x226
              kernel`sys___sysctlbyname+0x2d
              kernel`amd64_syscall+0x451
              kernel`0xffffffff8110146b

  2  18312 sysctl_root_handler_locked:return 
              kernel`sysctl_root+0x22f
              kernel`userland_sysctl+0x1b6
              kernel`kern___sysctlbyname+0x226
              kernel`sys___sysctlbyname+0x2d
              kernel`amd64_syscall+0x451
              kernel`0xffffffff8110146b

  2  18316               sysctl_root:return 
              kernel`userland_sysctl+0x1b6
              kernel`kern___sysctlbyname+0x226
              kernel`sys___sysctlbyname+0x2d
              kernel`amd64_syscall+0x451
              kernel`0xffffffff8110146b

  2  34058           userland_sysctl:return 
              kernel`kern___sysctlbyname+0x226
              kernel`sys___sysctlbyname+0x2d
              kernel`amd64_syscall+0x451
              kernel`0xffffffff8110146b

  2  34062       kern___sysctlbyname:return 
              kernel`sys___sysctlbyname+0x2d
              kernel`amd64_syscall+0x451
              kernel`0xffffffff8110146b

  2  53479        sys___sysctlbyname:return 
              kernel`amd64_syscall+0x451
              kernel`0xffffffff8110146b

We can fix nestat(1) to ignore ENOMEM on sysctl(3):

The information is copied into the buffer specified by oldp.  The size of
the buffer is given by the location specified by oldlenp before the call,
and that location gives the amount of data copied after a successful call
and after a call that returns with the error code ENOMEM.  If the amount
of data available is greater than the size of the buffer supplied, **the
call supplies as much data as fits in the buffer provided and returns
with the error code ENOMEM**.  If the old value is not desired, oldp and
oldlenp should be set to NULL.

And merge that to stable/*.