If that trace is right something is very very wrong in kernel land somewhere
Its
idle task
snoozing
handled an interrupt and returned
bottom half functions were pending
called net_bh
somehow got into timer_bh
then ip_rcv
I think the timer_bh is just stack space confusing the trace, and it went
receive an ip frame
try to defragment it
too many fragmented packets
purge the fragment queue
freeing a queue
delete its timer
blam...
That could well be a real bug because thats a "doesnt normally occur" code path.
I can't at the moment see how it could crash. Will dig further
Alan