--- a/sys/vfs/procfs/procfs_subr.c	2026-09-08 00:11:21.373570715 +0000
+++ b/sys/vfs/procfs/procfs_subr.c	2026-09-08 00:11:21.373570715 +0000
@@ -543,7 +543,15 @@
 		vhold(vp);
 		spin_unlock(&ph->spin);
 		vx_get(vp);
-		pfs->pfs_pid |= PFS_DEAD; /* does not effect hash */
+		/*
+		 * The pfsnode can be reclaimed (and freed) by a concurrent
+		 * vgone_vxlocked() (vnlru under vnode pressure, or a forced
+		 * unmount) while we are blocked in vx_get() above.  v_data
+		 * can only transition under the VX lock, which we now hold,
+		 * so validate the cached pointer before writing through it.
+		 */
+		if (VTOPFS(vp) == pfs)
+			pfs->pfs_pid |= PFS_DEAD; /* does not effect hash */
 		vx_put(vp);
 		vdrop(vp);
 	}