--- a/sys/kern/lwkt_token.c	2026-06-29 12:51:19.000000000 +0000
+++ b/sys/kern/lwkt_token.c	2026-10-26 00:46:25.929086774 +0000
@@ -914,6 +914,12 @@
 void
 lwkt_token_init(lwkt_token_t tok, const char *desc)
 {
+	/*
+	 * NOTE: we cannot assert quiescence here.  Tokens are legitimately
+	 * (re-)initialized on recycled, non-zeroed memory (e.g. rman_init),
+	 * so t_count/t_ref cannot be distinguished from garbage at this
+	 * point.  Quiescence is enforced at lwkt_token_uninit() instead.
+	 */
 	tok->t_count = 0;
 	tok->t_ref = NULL;
 	tok->t_collisions = 0;
@@ -923,7 +929,11 @@
 void
 lwkt_token_uninit(lwkt_token_t tok)
 {
-	/* empty */
+	/* catch teardown with holders or waiters still referencing the
+	 * token (would otherwise leave dangling tr_tok backrefs) */
+	KKASSERT(tok->t_count == 0 && tok->t_ref == NULL);
+	tok->t_count = 0;
+	tok->t_ref = NULL;
 }
 
 /*