kern/56773: zfs device lookup protection fault

[prlw1%cam.ac.uk@localhost]

>Number:         56773
>Category:       kern
>Synopsis:       zfs device lookup protection fault
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Wed Mar 30 10:00:00 +0000 2022
>Originator:     Patrick Welche
>Release:        NetBSD-9.99.96/amd64
>Organization:
>Environment:
>Description:
Booting a 9.99.96 kernel(+modules) with a 9.99.95 userland gets me (typed)

ZFS filesystem version: 5
fatal protection fault in supervisor mode
trap type 4 code 0 rip 0xffffffff808d9917 cs 0x8 rflags 0x10206 cr2 0x74744701c000 ilevel 0x8 rsp 0xffff90014e46aa70
curlwp 0xffffb17a1f768540 pid 401.401 lowest kstack 0xffff90014e4662c0
kernel: protection fault trap, code-0
Stopped in pid 401.401 (zfs) at netbsd:device_lookup_acquire+0x75: movq 0(%rax,%r14,1),%r12
device_lookup_acquire() at netbsd:device_lookup_acquire+0x75
cdev_open() at netbsd:cdev_open+0xdc
spec_open() at netbsd:spec_open+0x224
VOP_OPEN() at netbsd:VOP_OPEN+0x36
vn_open() at netbsd:vn_open+0x32e
do_open() at netbsd:do_open+0xc33
do_sys_openat() at netbsd:do_sys_openat+0x74
sys_oepn() at netbsd:sys_open+0x24
syscall() at netbsd:syscall+0x18c
--- syscall (number 5) ---
netbsd:syscall+0x10c:
ds  6
es  0
fs  e1c8
gs  5390
rdi  6
rsi ffff900001fafdfb0
rbp ffff90014e46aa90
rbx  ffffffff816060e5  nb_zfsdev_bclose
rdx  8
rcx  6
rax  rc41e7894cee8944
r8  ffffffff816060e5  nb_zfsdev_bclose
r9  0
r10  0
r11  0
r12  be00
r13   0
r14  0
r15 ffffb17a1f768540
rip  ffffffff808d9917  device_lookup_acquire+0x75
cs  8
rflags  10206
rsp ffff90014e46aa70
ss  10
netbsd:device_lookup_acquire+0x75: movq 0(%rax,%r14,1),%r12



Oddly another zfs using box upgraded just fine, and playing spot the difference hasn't turned anything up.
>How-To-Repeat:

>Fix:
Stick to NetBSD-9.99.95/amd64