[console capture, kernel #0, unprivileged uid 1001, /tmp/typeconfuse /boot number (31337)]
mode=number path=/boot pid=844

Fatal trap 9: general protection fault while in kernel mode
cpuid = 0; lapic id = 0
instruction pointer	= 0x8:0xffffffff80671014
current process		= 844
current thread          = pri 6 (CRIT)

CPU0 stopping CPUs: 0x0000003e
 stopped
Stopped at      _mtx_lock_ex+0xc4:      movq    0x8(%rax),%rcx
db.

=> read side of the same exlink walk; for a prop_number the aliased mtx
   overlays the interned-number rb_node (pn_link), so the "mutex" fields
   are tree pointers.