backtrace without panic, MBuf leak in nd6_resolve() (was: MBuf leak in ether_output())

> There are generally two possible outcomes:
> 
> 1. The link-layer address is resolved.
[...]
> 2. The link-layer address resolution times out.
[...]

There appears to be another case: llatbl_drop_entry() being called before 
1. or 2. happens. Due to no-one incrementing la_numheld plus the strange 
while (...) condition, that will cause all mbufs on la_hold getting orphaned.

While I seem to have fixed the leak (by removing the la_numheld>0 clause),
I'd like to find out what actually triggers the problem. Since it triggers 
somewhat randomly and only on our active gateway, I can't simply panic() 
in lltable_drop_entry_queue().
I also fail to quickly identify a probable code path to that routine.
Is there a way to force a backtrace (written to the kernel log) in a 
routine without panic()ing?