kern/57061: null pointer dereference in zfs dnode_buf_evict_async -> dnode_destroy

[campbell+netbsd%mumble.net@localhost]

>Number:         57061
>Category:       kern
>Synopsis:       null pointer dereference in zfs dnode_buf_evict_async -> dnode_destroy
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Mon Oct 17 10:10:01 +0000 2022
>Originator:     Taylor R Campbell
>Release:        current
>Organization:
The NetBSD Faultation
>Environment:
NetBSD singbulli 9.99.100 NetBSD 9.99.100 (GENERIC) #38: Fri Sep 23 17:56:58 UTC 2022  root@singbulli:/home/riastradh/netbsd/current/obj.amd64/sys/arch/amd64/compile/GENERIC amd64
>Description:
[ 340993.363974] uvm_fault(0xffffffff81970a60, 0x0, 2) -> e
[ 340993.363974] fatal page fault in supervisor mode
[ 340993.363974] trap type 6 code 0x2 rip 0xffffffff83e7f34e cs 0x8 rflags 0x10286 cr2 0 ilevel 0 rsp 0xffffa7909ed4aea8
[ 340993.363974] curlwp 0xffffa13f4b2c3a40 pid 0.8875 lowest kstack 0xffffa7909ed462c0
[ 340993.363974] panic: trap
[ 340993.363974] cpu3: Begin traceback...
[ 340993.363974] vpanic() at netbsd:vpanic+0x183
[ 340993.363974] panic() at netbsd:panic+0x3c
[ 340993.363974] trap() at netbsd:trap+0xb27
[ 340993.363974] --- trap (number 6) ---
[ 340993.363974] list_remove() at solaris:list_remove+0xb
[ 340993.363974] dnode_destroy() at zfs:dnode_destroy+0x148
[ 340993.363974] dnode_buf_evict_async() at zfs:dnode_buf_evict_async+0x38
[ 340993.363974] task_executor() at solaris:task_executor+0x67
[ 340993.363974] threadpool_thread() at netbsd:threadpool_thread+0x1cc
>How-To-Repeat:
no idea
>Fix:
Yes, please!