===DF-2444: production dm_dev_create twice with the same name===
$ sysctl kern.dfmiscgo=dmeexist
dfmisc: dm_dev_create#1 r=0; #2 r=17 (EEXIST=17) out-param dmv=0xfffff8008de708c0

Call #2 hit the EEXIST path: dm_dev_destroy(dmv) ran (dm_dev.c:264)
and THEN *dmvp = dmv (dm_dev.c:267) handed the freed pointer to the
caller.  The current sole caller (dm_dev_create_ioctl, dm_ioctl.c:213)
checks r != 0 and never dereferences *dmvp, so no corruption is
reachable today -- latent caller-side UAF API hazard, demonstrated at
the production function level.