Fatal trap 12: page fault while in kernel mode
cpuid = 1; lapic id = 1
fault virtual address	= 0xfffff8011a1d5558
fault code		= supervisor write data, page not present
instruction pointer	= 0x8:0xffffffff8095da89
stack pointer	        = 0x10:0xfffff8011a5c4a20
frame pointer	        = 0x10:0xfffff8011a5c4ab0
code segment		= base 0x0, limit 0xfffff, type 0x1b
			= DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags	= interrupt enabled, resume, IOPL = 0
current process		= Idle
current thread          = pri 12 (CRIT)
kernel: type 12 trap, code=2

CPU1 stopping CPUs: 0x0000003d
 stopped
Stopped at      hammer2_primary_xops_thread+0x2d9:      lock xaddl      %edx,0x81558(%rsi)
db>

=== Kernel mount trace preceding the panic ===
hammer2_mount: devstr="/dev/vn0@testpfs"
hammer2_mount: device="/dev/vn0" label="testpfs" rdonly=0
hammer2_mount: hmp=0xfffff80118780000 matched
hammer2_mount: hmp=0xfffff80118780000 pmp=0xfffff8011a154000
hammer2_mount: devstr="/dev/vn1@DATA"
hammer2_mount: device="/dev/vn1" label="DATA" rdonly=0
hammer2_mount: "/dev/vn1": no recovery needed
hammer2_mount: hmp=0xfffff8011a72d000 pmp=0xfffff8011aec0000
ADD LOCAL PFS (IOCTL): testpfs
hammer2_mount: devstr="/dev/vn1@testpfs"
hammer2_mount: device="/dev/vn1" label="testpfs" rdonly=0
hammer2_mount: hmp=0xfffff8011a72d000 matched
hammer2_mount: hmp=0xfffff8011a72d000 pmp=0xfffff8011a154000   <-- SAME PMP: vn1 SLAVE chain added
hammer2_mount: PFS already mounted!
hammer2_mount: devstr="/dev/vn1@testpfs"
hammer2_mount: hmp=0xfffff8011a72d000 pmp=0xfffff8011a154000
hammer2_mount: PFS already mounted!

=== Analysis ===
The testpfs PMP (0xfffff8011a154000) gained nchains=2 when vn1@DATA was mounted
(hammer2_update_pmps found the SLAVE testpfs with matching clid and added its chain
to the existing PMP).  After vn1@DATA was unmounted, the SLAVE chain was NOT removed
(hmp->mount_count > 0 caused early return before pfsfree_scan).  When vn0@testpfs
was unmounted, hammer2_xop_helper_cleanup iterated only pfs_nmasters=1 (MASTER),
stopping thread[0] but leaving thread[1] (SLAVE) running.  kfree(xop_groups) freed
the backing memory.  The orphan thread[1] then accessed freed heap at
hammer2_primary_xops_thread+0x2d9 (atomic xadd on thr->flags offset), page-faulting
on the freed page at 0xfffff8011a1d5558.