--- a/sys/sys/tree.h	2026-06-29 12:51:19.000000000 +0000
+++ b/sys/sys/tree.h	2026-10-26 04:12:37.320106638 +0000
@@ -733,9 +733,12 @@
 									\
 	RB_SCAN_LOCK(&head->rbh_spin);					\
 	infopp = &RB_INPROG(head);					\
-	while (*infopp != scan) 					\
+	while (*infopp != NULL && *infopp != scan)			\
 		infopp = &(*infopp)->link;				\
-	*infopp = scan->link;						\
+	if (*infopp == scan)						\
+		*infopp = scan->link;					\
+	/* else: corrupted inprog list - do not touch it (the old walk	\
+	 * ran off the chain end and dereferenced NULL) */		\
 	RB_SCAN_UNLOCK(&head->rbh_spin);				\
 }									\
 									\