Two panics involving pipeclose()

[Edgar Fuß <ef%math.uni-bonn.de@localhost>]

I got two panics on 6.1/amd64 servers (while re-starting dovecot) involving 
pipeclose:

First:
[scrolled away]
p fffffe80b8ax2ac0
kernel: page fault trap, code=0
Stopped in pid 12690.1 (dovecot) at	netbsd_sleepq_remove+0x21:	movq	%rdx,118(%rax)
db{0}> bt
sleepq_remove() at netbsd:sleepq_remove+0x21
cv_wakeup_all() at netbsd:cv_wakeup_all+0x4b
pipeclose() at netbsd:pipeclose+0x9e
pipe_close() at netbsd:pipe_close+0x10
closef() at netbsd:closef+0x4a
fs_close() at netbsd:fs_close+0x116
syscall() at netbsd:syscall+0xc4
[forgot show reg]

Second:
fatal protection fault in supervisor mode
trap type 4 code 0 rip ffffffff80268015 cs 8 rflags 10202 cr2  7f7ff7b6d0008 cpl0 rsp fffffe8000a38a70
kernel: protection fault trap, code=0
Stopped in pid 1243.1 (dovecot) at 	netbsd:knote+0x22:	movq	8(%rbx) %r12
db{0}> bt
knote() at netbsd:knote+0x22
selnotif() at netbsd:selnotif+0x24
pipeselwakeup() at netbsd:pipeselwakeup+0x39
pipeclose() at netbsd:pipeclose+0x8d
pipe_close() at netbsd:pipe_close+0x18
closef() at netbsd:closef+0x4a
fd_close() at netbsd:fd_close+0x116
syscall() at netbsd:syscall+0xc4
db{0}> show reg
ds	0
es	0
fs	0
gs	ffff
rdi	fffffe80c394ddc0
rsi	1000000
rbp	fffffe8000a38a90
rbx	656e3431305c6564
rdx	1000000
rcx	0
rax	5
r8	7f7ff7b6d000
r9	0
r10	0
r11	217
r12	fffffe80c394ddc0
r13	1000000
r14	fffffe80c394dd00
r15	fffffe8059998340
rip	ffffffff80268015	knote+0x22
cs	0
rflags	10202
rsp	fffffe8000a38a70
ss	10
netbsd:knote+0x22:	movq	8(%rbx),%r12

In this one, it looks like rbx was over-written with a string.

Any hints?