crash on solaris9/sparc with 4.1.31

It built fine (once I found the current version, the mirror at 
ftp://ftp.gw.com/pub/unix/ip-filter/ does not...)
with ipfilter-4.1.31, and pfil-2.1.13.  Loads fine and runs, until I
enable ip_forwading between interfaces and start NATing traffic, then
I get a kernel panic in 
ipf:fr_timeoutstate -> ipf:fr_delstate -> ipf:ipf_rand_push -> ipf:MD5Update

[full dump below]
not sure what is relevant, 64-bit sparc, gcc 3.2.2, Only mod in the
makefiles was to select gcc.  

Thanks,
Chris.

panic[cpu0]/thread=2a10006bd40: 
BAD TRAP: type=31 rp=2a10006b3d0 addr=78216000 mmu_fsr=0
sched:  trap type = 0x31  addr=0x78216000
 pid=0, pc=0x1179388, sp=0x2a10006ac71, tstate=0x8880001607, context=0x0
g1-g7: 781d4a08, cc4, 8, 1, 0, 0, 2a10006bd40
000002a10006b0f0 unix:die+a4 (31, 2a10006b3d0, 78216000,0, 8, 8)
 %l0-3: 0000000000000000 0000000078216000 000002a10006b3d0 000002a10006b2c0
 %l4-7: 0000000000000031 8000000000000000 0000000000000000 0000030000252038
000002a10006b1d0 unix:trap+8e4 (2a10006b3d0, 0, 10000, 10200, 0, 0)
 %l0-3: 0000000000000001 0000000000000000 0000000001438788 0000000000000031
 %l4-7: 0000000000000006 0000000000000001 0000000000000000 0000000000000000
000002a10006b320 unix:ktl0+48 (ffffffffffffffff, f061e7c2, 4, fffffffffffffff8, 781d3fc7, 2a10006b61c)
  %l0-3: 0000000000000000 0000000000001400 0000008880001607 000000000102db68
  %l4-7: 000003000000f3d8 0000000001432204 0000000000000000 000002a10006b3d0
000002a10006b470 ipf:MD5Update+1f0 (78215540, 781d49dc, 17, fffffffffffbe9c0, 58, 0)
  %l0-3: 3ffffffffe6d1c10 000003000024e000 0000000000000000 000000000144f268
  %l4-7: 000000000144f1e0 000000000f03a940 0000000000000001 0000000078216000
000002a10006b670 ipf:ipf_rand_push+1e4 (30001602ff0, 298, 20, 3000257dfb0, 0, 1439000)
  %l0-3: 00000300000151c0 0000030000014fc8 00000300015f1910 0000030000015170
  %l4-7: 0000030000015198 8000000000000000 00000000014582a8 000003000024f038
000002a10006b750 ipf:fr_delstate+388 (30001602ff0, ffff, 22, 1, 2a10006bd44, 0)
  %l0-3: 0000000001400000 000002a10006bd40 00000000014582a8 00000000014582b0
  %l4-7: 0000000001458000 0000030000288bf0 000000000000000c 0000000000000000
000002a10006b820 ipf:fr_timeoutstate+a8 (780345e0, 0, 348, 348, 0, 0)
  %l0-3: 000002a10006bd40 00000000780345e0 0000000000000063 ffffffffffffffff
  %l4-7: 0000000001400090 000000000142e6b8 0000000000000000 00000000014db000
000002a10006b910 ipf:fr_slowtimer+d0 (0, 2a10006bd40, 20, 1438788, 16, 0)
  %l0-3: 0000000001400000 000002a10006bd40 000002a10001fd40 000002a10001fd40
  %l4-7: 0000000001438400 0000000000000031 0000000000000000 000002a10001fa00
000002a10006b9d0 genunix:callout_execute+90 (30000251038, 528, bfffffffffdd1da8, 1, 8, 8)
  %l0-3: 00000000781619ec 000003000077cfb8 00000000001866a5 00000000001866a5
  %l4-7: 0000030000251000 8000000000000000 0000000000000000 0000030000252038
000002a10006ba80 genunix:taskq_thread+188 (3000051fe60, 0, 1438788, 1438788, 3000051fe16, 0)
  %l0-3: 0000000001080448 000003000051fe28 000003000051bf18 0000000000010000
  %l4-7: 000003000051fe08 000003000051fe3a 000003000051fe38 000003000051fe30