[*] DF-2447 dm_dev_remove_ioctl UAF racer
[*] racers=6 iterations=3000 dev=df2447racer
[*] hammering remove-vs-remove race; expect INVARIANTS panic /
    slab freed-object deref / double-free / lockmgr-on-freed
[*] iter 0/3000 survived so far

<<< guest PANICKED here (ssh hung, run_root hit 120s wall); serial console: >>>

panic: Bad link elm 0xfffff80117ed3a40 prev->next != elm
cpuid = 5
Trace beginning at frame 0xfffff801185cb648
dm_dev_insert() at dm_dev_insert 0xffffffff82600f00 
dm_dev_insert() at dm_dev_insert 0xffffffff82600f00 
dm_dev_remove() at dm_dev_remove+0x25 0xffffffff82601305 
dm_dev_remove_ioctl() at dm_dev_remove_ioctl+0xb7 0xffffffff82601bf7 
dmioctl() at dmioctl+0x2eb 0xffffffff8260083b 
dev_dioctl() at dev_dioctl+0x65 0xffffffff8062cdb5 
Debugger("panic")
Stopped at      Debugger+0x7c:  movb    $0,0xbdaf09(%rip)
db> 

RUN_EXIT=<guest panicked before process exit; vm.sh run_root timed out at 120s>