Reconstructed from the serial console (the panic killed the guest before
the orchestrating shell could flush its log file; the disk was then
reverted for the fix build).

console:
  devuaf: SWAP old=0xfffff80116a0ef80 new=0xfffff8004f2a7c80 reused=0 (cpu 0)
  TRIG: page0[0] = 'A' (expected 'A', device alive)          [cpu-0 round, run.log]
  ...
  devuaf: SWAP old=0xfffff8004f2a7c80 new=0xfffff8004f2a7c80 reused=1 (cpu 1)
  panic: assertion "dev->si_object" failed in old_dev_pager_dtor at /usr/src/sys/vm/device_pager.c:343
  cpuid = 1
  Trace beginning at frame 0xfffff8011814d6f8
  old_dev_pager_dtor() at old_dev_pager_dtor+0x4d 0xffffffff80996d8d
  dev_pager_dealloc() at dev_pager_dealloc+0x36 0xffffffff80996e56
  vm_object_terminate() at vm_object_terminate+0x11e 0xffffffff809ac22e
  vm_object_deallocate() at vm_object_deallocate+0x85 0xffffffff809ac7a5
  vm_map_entry_dispose.isra.15() at vm_map_entry_dispose.isra.15+0xbf 0xffffffff809a1c1f

Interpretation: the cpu-1 round's SWAP destroyed the cdev at
0xfffff8004f2a7c80 and the replacement make_dev() *re-used the freed
chunk* (old == new, reused=1).  The unprivileged trigger then faulted
page 1 (served through the freed chunk) and called munmap(), which
drove vm_object_terminate -> dev_pager_dealloc -> old_dev_pager_dtor
into the freed-and-reused chunk whose si_object field was NULL (fresh
cdev) -> KKASSERT panic at device_pager.c:343.