kern/60305: panic in AIO

["logix%foobar.franken.de@localhost via gnats" <gnats-admin%NetBSD.org@localhost>]

>Number:         60305
>Category:       kern
>Synopsis:       panic in AIO
>Confidential:   no
>Severity:       serious
>Priority:       high
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Mon Jun 01 21:35:00 +0000 2026
>Originator:     Harold Gutch
>Release:        NetBSD current (~late 2026-03) kernel, chroot with 11.0 RC2 userland
>Organization:
The NEiTher kernel nor curproc BSD Foundation
>Environment:
NetBSD nintendo 11.99.5 NetBSD 11.99.5 (NINTENDO.MP) #9: Sat Mar 28 13:06:02 CET 2026  h@build:/home/h/netbsd/wiiu/sys/arch/evbppc/compile/NINTENDO.MP evbppc
>Description:
On a NetBSD current (~late 2026-03) evbppc installation running on a Wii U with a chroot with an 11.0 RC2 userland, building pkgsrc/net/nsca-ng (from pkgsrc 2026Q1) crashes the system:

panic: kernel diagnostic assertion "(VMSPACE_IS_KERNEL_P(uio->uio_vmspace) || uio->uio_vmspace == curproc->p_vmspace)" failed: file "/home/h/netbsd/git/src/sys/miscfs/specfs/spec_vnops.c", line 1217 vmspace belongs to neither kernel nor curproc
0x00e63d70: at kern_assert+0x60
0x00e63db0: at spec_write+0x3cc
0x00e63e20: at VOP_WRITE+0x9c
0x00e63e60: at vn_write+0xf0
0x00e63e90: at aiost_process_singleton+0x120
0x00e63ee0: at aiost_entry+0x2ac
0x00e63f20: at cpu_lwp_bootstrap+0xc
0x00e63fe8: at 0xfffffffc
>How-To-Repeat:
1) get NetBSD current running on WiiU
2) create chroot, populate directory with sets from ~11.0RC2 (I was using 20260308105915Z)
3) download/unpack pkgsrc 2026Q1 in chroot
4) kver -r 11.0 chroot /chroot/root /bin/sh
5) build pkgsrc/net/nsca-ng

(presumably the arch in step 1 and the pkgsrc release in step 3 are irrelevant, and step 4 can be skipped)
>Fix: