tcp_g_q has numerous messages queued on it (these are never consumed). This can use a significant amount of memory. The kmem_alloc_8192 buffer in which the message exists can never be freed by (for instance) the ipge driver. In one case 13Gb was eventually tied up this way (over a period of weeks).
A tnf probe in tcp_rput_data() shows tcp_state must have gone from TCPS_FIN_WAIT_1 on entry to TCPS_TIME_WAIT when it enqueues the new segment.