9.1: forcible coredump -> panic

[Mouse <mouse%Rodents-Montreal.ORG@localhost>]

I'm trying to add a deadman timer facility to 9.1's kernel which, from
a function called by a callout firing, forcibly coredumps a particular
process (which I want to do even if the process is blocking or ignoring
normally-core-generating signals):

But I'm finding it panicking instead.  My dev system is amd64, in case
that matters.

The callout-called function is

static void deadman_timeout(void *scv)
{
 SOFTC *sc;
 struct proc *p;
 lwp_t *l;

 sc = scv;
 mutex_enter(&deadman_mtx);
 sc->flags &= ~SCF_ARMED;
 mutex_exit(&deadman_mtx);
 printf("deadman timer %d fired\n",sc->inx);
 mutex_enter(proc_lock);
 p = proc_find_raw(sc->pid);
 if (! p)
  { printf("process not found\n");
    l = 0;
  }
 else
  { l = LIST_FIRST(&p->p_lwps);
  }
 mutex_exit(proc_lock);
 if (l) MODULE_HOOK_CALL_VOID(coredump_hook,(l,0),);
}

I see the "deadman timer %d fired" message.  But right after that (in
particular, without "process not found") I get a "fatal page fault in
supervisor mode"; the stack trace from ddb looks like

kcopy() at ...
uiomove() at ...
uvm_io() at ...
copyin_vmspace() at ...
copyin_proc() at ...
proc_getauxv() at ...
coredump_elf64() at ...
coredump() at ...
deadman_timeout() at ...
callout_softclock() at ...
softint_dispatch() at ...
DDB lost frame for netbsd:Xsoftintr+0x4f, ...
Xsoftintr() at ...
--- interrupt ---

Have I done something obviously stupid here?  I don't really know the
9.1 kernel all that well; the above was pulled together from fragments
I found scattered around in various files.  Is there a better way to
force a process to core?

/~\ The ASCII				  Mouse
\ / Ribbon Campaign
 X  Against HTML		mouse%rodents-montreal.org@localhost
/ \ Email!	     7D C8 61 52 5D E7 2D 39  4E F1 31 3E E8 B3 27 4B