kern/59458: crash when removing raidframe component

[dogcow%babymeat.com@localhost]

>Number:         59458
>Category:       kern
>Synopsis:       crash when removing raidframe component
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Wed Jun 04 16:30:00 +0000 2025
>Originator:     dogcow%babymeat.com@localhost
>Release:        NetBSD 10.99.14
>Organization:
	
>Environment:
	
	
System: NetBSD flippy.babymeat.com 10.99.14 NetBSD 10.99.14 (FLIPPY) #9: Tue Jun 3 18:32:21 CDT 2025 dogcow%flippy.babymeat.com@localhost:/crap/obj/hgcurobj/src/hg/src/sys/arch/amd64/compile/FLIPPY amd64
Architecture: x86_64
Machine: amd64
pts/0 dogcow@flippy: /src/hg/src 3064 % hg identify --num
519571+

>Description:
When removing a disk-exists-but-failed component from a configured raid
array, netbsd panics with
Jun  4 11:14:08 flippy savecore: reboot after panic: [ 250.8969354] panic: kernel diagnostic assertion "vp->v_writecount > 0" failed: file "/src/hg/src/sys/kern/vfs_vnops.c", line 487

and the gdb backtrace
#7  0xffffffff80486eca in rf_remove_component (
    raidPtr=raidPtr@entry=0xffffbd0020920208,
    component=component@entry=0xffffbd04b6664c2c)
    at /src/hg/src/sys/dev/raidframe/rf_disks.c:1244
1244                    return rf_delete_component(raidPtr, component);
(gdb) up
#8  0xffffffff8048fa22 in raidioctl (dev=<optimized out>, cmd=2151445015,
    data=0xffffbd04b6664ee0, flag=3, l=0xffff87c28837cc00)
    at /src/hg/src/sys/dev/raidframe/rf_netbsdkintf.c:1689
1689                    return rf_remove_component(raidPtr, &component);
(gdb) up
#9  0xffffffff805f3c7d in cdev_ioctl (dev=15907, cmd=2151445015,
    data=0xffffbd04b6664ee0, flag=3, l=<optimized out>)
    at /src/hg/src/sys/kern/subr_devsw.c:1535
1535            rv = (*d->d_ioctl)(dev, cmd, data, flag, l);

	
>How-To-Repeat:
	
[     6.548707] Configuring raid2:
[     6.548707] raid2: allocating 20 buffers of 65536 bytes.
[     6.548707] raid2: RAID Level 1
[     6.548707] raid2: Components: /dev/dk5 /dev/dk9[**FAILED**]
[     6.548707] raid2: Total Sectors: 9767540608 (4769306 MB)
[     6.558708] raid2: GPT GUID: 3d997aaa-31a6-4cf1-a005-2b2aca5f169e
[     6.558708] dk18 at raid2: "bk5tb", 9767540500 blocks at 64, type: ffs

pts/0 dogcow@flippy: ~ 3057 % sudo raidctl -r /dev/dk9 raid2
[crashes]

>Fix:
	
unknown, but I do have the kernel.gdb and core (-current is at hg rev 519571)

>Unformatted: