kern/60462: panic importing zpools under LOCKDEBUG

["riz%tastylime.net@localhost via gnats" <gnats-admin%NetBSD.org@localhost>]

>Number:         60462
>Category:       kern
>Synopsis:       panic importing zpools under LOCKDEBUG
>Confidential:   no
>Severity:       serious
>Priority:       high
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sun Jul 19 03:15:00 +0000 2026
>Originator:     Jeff Rizzo
>Release:        11.99.7
>Organization:
>Environment:
[   1.0000000] NetBSD 11.99.7 (GENERIC_LOCKDEBUG) #0: Sun Jul 19 00:50:26 UTC 2026
[   1.0000000] 	riz%acai.tastylime.net@localhost:/tank/netbsd/current/obj/sys/arch/amd64/compile/GENERIC_LOCKDEBUG
>Description:
While debugging another issue (PR#60457), I ran into a repeatable panic in a LOCKDEBUG kernel upon reboot:

Sat Jul 18 19:16:27 PDT 2026
Starting root file system check:
/dev/rdk0: 61788 files, 1172986 used, 100454123 free (1627 frags, 12556562 blocks, 0.0% fragmentation)
/dev/rdk0: MARKING FILE SYSTEM CLEAN
[  21.2583656] ZFS filesystem version: 5
[  24.0084563] Mutex error: kmem_intr_free,397: allocation contains active lock

[  24.0183539] lock address : ffff843809f972f0
[  24.0283529] type         : sleep/adaptive
[  24.0283529] initialized  : zfs:rrw_init+0x19
[  24.0283529] shared holds :                  0 exclusive:                  0
[  24.0383528] shares wanted:                  0 exclusive:                  0
[  24.0483529] relevant cpu :                  3 last held:                  9
[  24.0583528] relevant lwp : 0xffff84380afd8800 last held: 000000000000000000
[  24.0683528] last locked  : 0
[  24.0683528] unlocked*    : 0
[  24.0683528] owner field  : 000000000000000000 wait/spin:                0/0
[  24.0783527] Turnstile: no active turnstile for this lock.

[  24.0883527] panic: LOCKDEBUG: Mutex error: kmem_intr_free,397: allocation contains active lock
[  24.0983526] cpu3: Begin traceback...
[  24.0983526] vpanic() at netbsd:vpanic+0x189
[  24.1083526] panic() at netbsd:panic+0x3c
[  24.1083526] lockdebug_abort1() at netbsd:lockdebug_abort1+0xdd
[  24.1183526] kmem_intr_free() at netbsd:kmem_intr_free+0x91
[  24.1283527] dsl_dataset_hold_obj() at zfs:dsl_dataset_hold_obj+0x4ff
[  24.1283527] dsl_dataset_hold_obj() at zfs:dsl_dataset_hold_obj+0x575
[  24.1383525] dmu_objset_find_dp_impl() at zfs:dmu_objset_find_dp_impl+0xf1
[  24.1483524] dmu_objset_find_dp_cb() at zfs:dmu_objset_find_dp_cb+0x25
[  24.1583524] task_executor() at solaris:task_executor+0x67
[  24.1583524] threadpool_thread() at netbsd:threadpool_thread+0xd8
[  24.1683524] cpu3: End traceback...
[  24.1683524] fatal breakpoint trap in supervisor mode
[  24.1783523] trap type 1 code 0 rip 0xffffffff8023541d cs 0x8 rflags 0x202 cr2 0 ilevel 0 rsp 0xffffca14bca93bd0
[  24.1883523] curlwp 0xffff84380afd8800 pid 0.740 lowest kstack 0xffffca14bca8f2c0
Stopped in pid 0.740 (system) at        netbsd:breakpoint+0x5:  leave
breakpoint() at netbsd:breakpoint+0x5
vpanic() at netbsd:vpanic+0x189
panic() at netbsd:panic+0x3c
lockdebug_abort1() at netbsd:lockdebug_abort1+0xdd
kmem_intr_free() at netbsd:kmem_intr_free+0x91
dsl_dataset_hold_obj() at zfs:dsl_dataset_hold_obj+0x4ff
dsl_dataset_hold_obj() at zfs:dsl_dataset_hold_obj+0x575
dmu_objset_find_dp_impl() at zfs:dmu_objset_find_dp_impl+0xf1
dmu_objset_find_dp_cb() at zfs:dmu_objset_find_dp_cb+0x25
task_executor() at solaris:task_executor+0x67
threadpool_thread() at netbsd:threadpool_thread+0xd8
ds          0
es          3
fs          3c18
gs          3b80
rdi         0
rsi         2d6
rbp         ffffca14bca93bd0
rbx         ffffffff81700568
rdx         1
rcx         ffffffffffffff
rax         800000000000000
r8          0
r9          0
r10         0
r11         ffffffff81612ae2    ostype+0x54f72
r12         ffffca14bca93c18
r13         104
r14         ffffffff81700678
r15         1
rip         ffffffff8023541d    breakpoint+0x5
cs          8
rflags      202
rsp         ffffca14bca93bd0
ss          10
netbsd:breakpoint+0x5:  leave
db{3}>
>How-To-Repeat:
Boot a LOCKDEBUG kernel with this particular zpool
>Fix:
Per riastradh, its missing some "rrw_destroy(&ds->ds_bp_rwlock); in a couple kmem_free(ds, ...) branches