panic: assertion "((so->so_proto->pr_flags & PR_ASYNC_RCVD) == 0 && so->so_refs == 2) || ((so->so_proto->pr_flags & PR_ASYNC_RCVD) && so->so_refs == 3)" failed in sonewconn_faddr at /usr/src/sys/kern/uipc_socket2.c:404
cpuid = 5
Trace beginning at frame 0xfffff8008d2a9890
sonewconn_faddr() at sonewconn_faddr+0x459 0xffffffff806c9a89
sonewconn_faddr() at sonewconn_faddr+0x459 0xffffffff806c9a89
ng_btsocket_l2cap_input() at ng_btsocket_l2cap_input+0x19eb 0xffffffff8261088b
taskqueue_run() at taskqueue_run+0xbb 0xffffffff806a3c5b
ithread_handler() at ithread_handler+0x2fe 0xffffffff80620f1e
Debugger("panic")

CPU5 stopping CPUs: 0x0000001f
 stopped
Stopped at      Debugger+0x7c:  movb    $0,0xbdaf09(%rip)
db>

---
Triggered by the DF-3480 harness (btsbx.ko fake lower layer delivering an
NGM_L2CAP_L2CA_CON_IND for a PSM a local listener is bound to): the inbound
connection path calls sonewconn() -> pru_attach ->
ng_btsocket_l2cap_attach(), which links the pcb to the socket without taking
the "implied pcb ref" (soreference) that sonewconn's contract requires
(uipc_socket2.c:398-404; compare in_pcballoc() -> soreference(),
sys/netinet/in_pcb.c:295).