--- a/sys/kern/vfs_init.c	2026-06-29 12:51:19.000000000 +0000
+++ b/sys/kern/vfs_init.c	2026-10-26 00:25:42.789042927 +0000
@@ -335,12 +335,26 @@
 	 * preserved by re-registering the oid after modifying its
 	 * number.
 	 */
-	SLIST_FOREACH(oidp, &sysctl__vfs_children, oid_link)
-		if (strcmp(oidp->oid_name, vfc->vfc_name) == 0) {
-			sysctl_unregister_oid(oidp);
-			oidp->oid_number = vfc->vfc_typenum;
-			sysctl_register_oid(oidp);
+	/*
+	 * Do not mutate the iterated list mid-loop: find the (unique)
+	 * matching oid first, then renumber and re-register it after
+	 * the traversal.
+	 */
+	{
+		struct sysctl_oid *match = NULL;
+
+		SLIST_FOREACH(oidp, &sysctl__vfs_children, oid_link) {
+			if (strcmp(oidp->oid_name, vfc->vfc_name) == 0) {
+				match = oidp;
+				break;
+			}
+		}
+		if (match != NULL) {
+			sysctl_unregister_oid(match);
+			match->oid_number = vfc->vfc_typenum;
+			sysctl_register_oid(match);
 		}
+	}
 	
 	/*
 	 * Initialise unused fields in the file system's vfsops vector.