There was a fix for a crash in NAT code applied here:
https://reviews.freebsd.org/D29838
HoweverWhile debugging some rare crashes in the ng_nat(4) code, which seems like mbuf is being corrupted in libalias, it's been noticed that two distinct KASSERTs in the m_apply() function have exactly the same panic message, that did not include ng_nat module which turns out also susceptiblemaking it impossible to distinguish after the fact. We've seen one of those crashes in production.