Commit #59ae9fc67007da8b5aea7b0a31c3607745cfbfee by Zoltan Kiss may be related to this bug.
"A recent commit (a02eb4 "xen-netback: worse-case estimate in xenvif_rx_action is underestimating") capped the slot estimation to MAX_SKB_FRAGS, but that triggers the next BUG_ON a few lines down, as the packet consumes more slots than estimated.[..]"