panic: memory chunk 0xfffff8008971f880 is already free!
cpuid = 0
Trace beginning at frame 0xfffff8008974b950
chunk_mark_free() at chunk_mark_free+0xae 0xffffffff80655dbe
chunk_mark_free() at chunk_mark_free+0xae 0xffffffff80655dbe
slab_cleanup() at slab_cleanup+0xbb 0xffffffff8065662b
slotimer_callback() at slotimer_callback+0x11 0xffffffff80687d81
softclock_handler() at softclock_handler+0x1b8 0xffffffff80688438
Debugger("panic")

CPU0 stopping CPUs: 0x0000003e
 stopped
Stopped at      Debugger+0x7c:  movb    $0,0xbdaf09(%rip)
db>

# Captured verbatim from dfbsd-qemu/vm.sh log after run 1 (variant "sig"):
#   guest X86_64_GENERIC INVARIANTS kernel, debug.use_weird_array=1,
#   loopback NFS mount 127.0.0.1:/tmp on /mnt/nfspoc (non-KERB),
#   poc /mnt/nfspoc sig  (child enters nfssvc(NFSSVC_MNTD); parent SIGTERMs it)
#
# The slab allocator's INVARIANTS integrity checker caught a DOUBLE FREE:
# the nfsmount was kfree()d once by nfs_unmount() (called from
# nfs_clientd's own EINTR dounmount at nfs_kerb.c:126, non-KERB path
# nfs_vfsops.c:1242-1244) and then freed AGAIN by nfs_clientd's teardown
# nfs_free_mount(nmp) at nfs_kerb.c:138 after the loop condition at
# nfs_kerb.c:106 read the freed (poisoned, NFSSTA_DISMNT-bit-set)
# nm_state and fell out of the loop.