I've been slowly trying to sort out the bugs I've been seeing in the FreeBSD Xen code. The first annoying crash(es) are in the netfront network driver.
I started digging in the driver and found that the bug in question is due to some reasonably brain dead behaviour in the TX mbuf ring allocation. I've committed code to FreeBSD-current which enforces that there's space in the TX mbuf ring. I'm about to commit further fixes to enforce that there's space in the Xenbus TX ring.
The current Linux code has the same flaw. It may not be so easily tickled in Linux due to the driver model but it should still be explicitly catered for. That said, I get plenty of random network interface hangs in Linux/Xen; perhaps this stuff is related.