--- a/sys/vfs/procfs/procfs_vfsops.c	2026-06-29 12:51:19.000000000 +0000
+++ b/sys/vfs/procfs/procfs_vfsops.c	2026-10-26 03:30:28.492168405 +0000
@@ -61,6 +61,8 @@
  * mount system call
  */
 /* ARGSUSED */
+static int procfs_atexit_registered;
+
 static int
 procfs_mount(struct mount *mp, char *path, caddr_t data, struct ucred *cred)
 {
@@ -70,10 +72,18 @@
 	if (mp->mnt_flag & MNT_UPDATE)
 		return (EOPNOTSUPP);
 
-	if (mp->mnt_vfc->vfc_refcount == 1 && (error = at_exit(procfs_exit))) {
+	/*
+	 * Register the exit handler once; never deregister.  The old
+	 * vfc_refcount == 1 gate was racy between concurrent mounts
+	 * (both could skip registration).  procfs_exit is a no-op when
+	 * no pfsnodes exist.
+	 */
+	if (!procfs_atexit_registered &&
+	    (error = at_exit(procfs_exit))) {
 		kprintf("procfs:  cannot register procfs_exit with at_exit\n");
 		return(error);
 	}
+	procfs_atexit_registered = 1;
 
 	mp->mnt_flag |= MNT_LOCAL;
 	mp->mnt_kern_flag |= MNTK_NOSTKMNT;
@@ -106,8 +116,7 @@
 	if (error)
 		return (error);
 
-	if (mp->mnt_vfc->vfc_refcount == 1)
-		rm_at_exit(procfs_exit);
+	/* handler stays registered; see procfs_mount */
 
 	return (0);
 }