A similar/related issue is supposedly fixed with an haproxy update from upstream:
https://redmine.pfsense.org/issues/15457
See discussion:
https://forum.netgate.com/topic/188861/
There's a request there for a full core dump to aid in further troubleshooting.
Backtrace and panic from attached dumps:
db:1:pfs> bt
Tracing pid 2 tid 100149 td 0xfffff80005d3d740
kdb_enter() at kdb_enter+0x33/frame 0xfffffe00fda178f0
panic() at panic+0x43/frame 0xfffffe00fda17950
trap_fatal() at trap_fatal+0x40f/frame 0xfffffe00fda179b0
trap_pfault() at trap_pfault+0x4f/frame 0xfffffe00fda17a10
calltrap() at calltrap+0x8/frame 0xfffffe00fda17a10
--- trap 0xc, rip = 0xffffffff80f246e2, rsp = 0xfffffe00fda17ae0, rbp = 0xfffffe00fda17b70 ---
tcp_m_copym() at tcp_m_copym+0x62/frame 0xfffffe00fda17b70
tcp_default_output() at tcp_default_output+0x1294/frame 0xfffffe00fda17d60
tcp_timer_rexmt() at tcp_timer_rexmt+0x53c/frame 0xfffffe00fda17dc0
tcp_timer_enter() at tcp_timer_enter+0x101/frame 0xfffffe00fda17e00
softclock_call_cc() at softclock_call_cc+0x12e/frame 0xfffffe00fda17ec0
softclock_thread() at softclock_thread+0xe9/frame 0xfffffe00fda17ef0
fork_exit() at fork_exit+0x7f/frame 0xfffffe00fda17f30
fork_trampoline() at fork_trampoline+0xe/frame 0xfffffe00fda17f30
--- trap 0, rip = 0, rsp = 0, rbp = 0 ---
Fatal trap 12: page fault while in kernel mode
cpuid = 12; apic id = 10
fault virtual address = 0x1c
fault code = supervisor read data, page not present
instruction pointer = 0x20:0xffffffff80f246e2
stack pointer = 0x28:0xfffffe00fda17ae0
frame pointer = 0x28:0xfffffe00fda17b70
code segment = base 0x0, limit 0xfffff, type 0x1b
= DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags = interrupt enabled, resume, IOPL = 0
current process = 2 (clock (12))
rdi: 0000000000000000 rsi: 0000000000000000 rdx: fffffe00fda17cf8
rcx: 0000000000000000 r8: 0000000000000598 r9: 0000000000000000
rax: 0000000000000000 rbx: 0000000000000000 rbp: fffffe00fda17b70
r10: 0000000000001fe7 r11: 000000000000df51 r12: 0000000000000000
r13: 0000000000000598 r14: fffff805dfc21a80 r15: 0000000000000034
trap number = 12
panic: page fault
cpuid = 12
time = 1721814976
KDB: enter: panic