When refill_fl() fails to allocate large (9/16KB) mbuf cluster, it falls back to safe (4KB) ones. But it still saved into sd->zidx the original fl->zidx instead of fl->safe_zidx. It caused number of problems with the later use of that cluster, including possibility of memory and/or data corruption.
While there, make refill_fl() to fallback to the safe zone for all the following clusters of the call.