mutex_oncpu() called on destroyed mutex? (was: repeated panics in mutex_vector_enter (from unp_thread))

[Edgar Fuß <ef%math.uni-bonn.de@localhost>]

I observe this on 6.1, but I can't see the relevant code changed in current.

mutex_vector_enter() does (-current uses KPREMPT_* macros)

	do {
		kpreempt_enable();
		SPINLOCK_BACKOFF(count);
		kpreempt_disable();
		owner = mtx->mtx_owner;
	} while (mutex_oncpu(owner));

and my problem seems to be owner == MUTEX_THREAD (i.e. the mutex destroyed) 
the time mutex_oncpu(owner) is called.

My understanding of locking is limited (close to zero) but why shouldn't 
the mutex in question be destroyed during the preemption-enabled period?

I must be missing something.