Panic occurs on icmp packets when initiating punchin on a TX ALL_ZONES interface.
ip_wput_ire() is called with a zoneid and the packet it is called for may have an M_CTL.
In the case of M_CTL, ip_wput_ire asserts that the M_CTL zoneid is the same as the zoneid it was called with and it is not ALL_ZONES.
If the M_CTL was previously attached this must be true. But if the M_CTL is added by ip_wput_attach_policy() from inside ip_wput_ire() (due to a global policy) then zoneid came from an ire and therefore may be ALL_ZONES.