mbuf mem leak in 3.6

[Anders B Jansson <hdw_(_at_)_kallisti_(_dot_)_se>]

Forwarding packets from em0 to xl0 causes severe mbuf leak.

Pushing a 1 GB file thru the box produces the following:
Before:
raider# netstat -m
4141 mbufs in use:
        2284 mbufs allocated to data
        1853 mbufs allocated to packet headers
        4 mbufs allocated to socket names and addresses
403/436/6144 mbuf clusters in use (current/peak/max)
1936 Kbytes allocated to network (95% in use)
0 requests for memory denied
0 requests for memory delayed
0 calls to protocol drain routines

After:
raider# netstat -m
5243 mbufs in use:
        3386 mbufs allocated to data
        1853 mbufs allocated to packet headers
        4 mbufs allocated to socket names and addresses
954/994/6144 mbuf clusters in use (current/peak/max)
3320 Kbytes allocated to network (96% in use)
0 requests for memory denied
0 requests for memory delayed
0 calls to protocol drain routines
raider#

About 500 lost mbuf clusters per GB, and they never comes back and can 
be repeated until I run out of mbuf clusters.

In more detail.
Workstation (Leviathan) running Windows XP/Home with Intel Gb NIC,
Server (Raider), detailed belowed, 3.6 cvs update, Intel Gb NIC (em0) 
and 3com Fast Ethernet xl0.
Target (shuttle), Windows 2000, builtin Fastethernet.

Pushing the same file from Leviathan to Raider and then from Raider to 
Shuttle (using a samba share) causes to no issues.
Pushing data from Shuttle to Leviathan causes no issues.

It's only when the traffic is routed thru Raider that the I lose mbuf 
clusters.

I've also run the test without Samba running (pure default install, 
forwarding switched on), no change, passing the traffic from the Gig NIC 
to the FE NIC causes it to lose mbuf clusters.

Raider is installed with 3.6 snapshot upgraded to 3.6 (stable) from cvs 
and make build (had a motherboard crash, couldn't wait for my 3.6 CD's).
GENERIC is untouched with the exception of ccd count increased to 6.

Raider's dmesg:
raider:hdw {116} dmesg
OpenBSD 3.6 (GENERIC) #1: Fri Oct  8 12:18:18 CEST 2004
    srcadmin_(_at_)_raider_(_dot_)_int_(_dot_)_kallisti_(_dot_)_se:/usr/src/sys/arch/i386/compile/GENERIC
cpu0: AMD Duron(TM) ("AuthenticAMD" 686-class) 1.20 GHz
cpu0: 
FPU,V86,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,MMX,FXSR,SSE
real mem  = 268001280 (261720K)
avail mem = 237527040 (231960K)
using 3297 buffers containing 13504512 bytes (13188K) of memory
mainbus0 (root)
bios0 at mainbus0: AT/286+(9f) BIOS, date 06/10/04, BIOS32 rev. 0 @ 0xf1930
apm0 at bios0: Power Management spec V1.2
apm0: AC on, battery charge unknown
pcibios0 at bios0: rev 2.1 @ 0xf0000/0x2012
pcibios0: PCI IRQ Routing Table rev 1.0 @ 0xf1f10/256 (14 entries)
pcibios0: PCI Interrupt Router at 000:17:0 ("VIA VT82C586 ISA" rev 0x00)
pcibios0: PCI bus #1 is the last bus
bios0: ROM list: 0xc0000/0x8000 0xc8000/0x1800 0xcc000/0x2200
cpu0 at mainbus0
pci0 at mainbus0 bus 0: configuration mode 1 (no bios)
pchb0 at pci0 dev 0 function 0 "VIA VT8377 PCI" rev 0x00
ppb0 at pci0 dev 1 function 0 "VIA VT8235 AGP" rev 0x00
pci1 at ppb0 bus 1
vga1 at pci1 dev 0 function 0 "Matrox MGA G400/G450 AGP" rev 0x04
wsdisplay0 at vga1: console (80x25, vt100 emulation)
wsdisplay0: screen 1-5 added (80x25, vt100 emulation)
pciide0 at pci0 dev 11 function 0 "HighPoint HPT302 IDE" rev 0x01: DMA
pciide0: using irq 3 for native-PCI interrupt
wd0 at pciide0 channel 0 drive 0: <Maxtor 6Y120L0>
wd0: 16-sector PIO, LBA, 117246MB, 240121728 sectors
wd0(pciide0:0:0): using PIO mode 4, Ultra-DMA mode 6
wd1 at pciide0 channel 1 drive 0: <Maxtor 6Y120L0>
wd1: 16-sector PIO, LBA, 117246MB, 240121728 sectors
wd1(pciide0:1:0): using PIO mode 4, Ultra-DMA mode 6
xl0 at pci0 dev 14 function 0 "3Com 3c905B 100Base-TX" rev 0x30: irq 3, 
address 00:50:04:f7:71:d4
exphy0 at xl0 phy 24: 3Com internal media interface
uhci0 at pci0 dev 16 function 0 "VIA VT83C572 USB" rev 0x80: irq 7
usb0 at uhci0: USB revision 1.0
uhub0 at usb0
uhub0: VIA UHCI root hub, class 9/0, rev 1.00/1.00, addr 1
uhub0: 2 ports with 2 removable, self powered
uhci1 at pci0 dev 16 function 1 "VIA VT83C572 USB" rev 0x80: irq 7
usb1 at uhci1: USB revision 1.0
uhub1 at usb1
uhub1: VIA UHCI root hub, class 9/0, rev 1.00/1.00, addr 1
uhub1: 2 ports with 2 removable, self powered
uhci2 at pci0 dev 16 function 2 "VIA VT83C572 USB" rev 0x80: irq 7
usb2 at uhci2: USB revision 1.0
uhub2 at usb2
uhub2: VIA UHCI root hub, class 9/0, rev 1.00/1.00, addr 1
uhub2: 2 ports with 2 removable, self powered
ehci0 at pci0 dev 16 function 3 "VIA VT6202 USB 2.0" rev 0x82: irq 7
ehci0: EHCI version 1.0
ehci0: companion controllers, 2 ports each: uhci0 uhci1 uhci2
usb3 at ehci0: USB revision 2.0
uhub3 at usb3
uhub3: VIA EHCI root hub, class 9/0, rev 2.00/1.00, addr 1
uhub3: 6 ports with 6 removable, self powered
pcib0 at pci0 dev 17 function 0 "VIA VT8235 ISA" rev 0x00
pciide1 at pci0 dev 17 function 1 "VIA VT82C571 IDE" rev 0x06: ATA133, 
channel 0 configured to compatibility, channel 1 configured to compatibility
wd2 at pciide1 channel 0 drive 0: <Maxtor 6Y120L0>
wd2: 16-sector PIO, LBA, 117246MB, 240121728 sectors
atapiscsi0 at pciide1 channel 0 drive 1
scsibus0 at atapiscsi0: 2 targets
cd0 at scsibus0 targ 0 lun 0: <SAMSUNG, CD-R/RW SW-208B, BS04> SCSI0 
5/cdrom removable
wd2(pciide1:0:0): using PIO mode 4, Ultra-DMA mode 6
cd0(pciide1:0:1): using PIO mode 4, DMA mode 2
wd3 at pciide1 channel 1 drive 0: <Maxtor 6Y120L0>
wd3: 16-sector PIO, LBA, 117246MB, 240121728 sectors
wd3(pciide1:1:0): using PIO mode 4, Ultra-DMA mode 6
em0 at pci0 dev 19 function 0 "Intel PRO/1000MT (82540EM)" rev 0x02: irq 
12, address: 00:07:e9:10:bb:4e
isa0 at pcib0
isadma0 at isa0
pckbc0 at isa0 port 0x60/5
pckbd0 at pckbc0 (kbd slot)
pckbc0: using irq 1 for kbd slot
wskbd0 at pckbd0: console keyboard, using wsdisplay0
pcppi0 at isa0 port 0x61
midi0 at pcppi0: <PC speaker>
sysbeep0 at pcppi0
it0 at isa0 port 0x290/8: IT87
npx0 at isa0 port 0xf0/16: using exception 16
pccom0 at isa0 port 0x3f8/8 irq 4: ns16550a, 16 byte fifo
biomask efed netmask ffed ttymask ffef
pctr: user-level cycle counter enabled
mtrr: Pentium Pro MTRR support
dkcsum: wd0 matched BIOS disk 80
dkcsum: wd1 matched BIOS disk 81
dkcsum: wd2 matched BIOS disk 82
dkcsum: wd3 matched BIOS disk 83
root on wd0a
rootdev=0x0 rrootdev=0x300 rawdev=0x302