Second manifestation of the destroy-while-queued UAF (before the struct
layout was pinned down in the harness: the groom wrote wrong offsets into the
freed chunk, so the kernel read a garbage map->dmat -> NULL bounce_zone and
faulted inside the inlined reserve_bounce_pages within get_map_waiting):

Fatal user address access from kernel mode from kldload at ffffffff80c1976e

Fatal trap 12: page fault while in kernel mode
cpuid = 5; lapic id = 5
fault virtual address = 0x34
fault code = supervisor read data, page not present
instruction pointer = 0x8:0xffffffff80c1976e
current process = 961
current thread = pri 6 (CRIT)
kernel: type 12 trap, code=0

CPU5 stopping CPUs: 0x0000001f
Stopped at get_map_waiting.isra.8+0x1e: movl 0x34(%rcx),%esi
db>

Disassembly of the faulting function (kernel /boot/kernel/kernel):
ffffffff80c19750 <get_map_waiting.isra.8>:
ffffffff80c19750: mov 0x18(%rdi),%rax        ; bz->bounce_map_waitinglist.first
ffffffff80c19760: mov 0x18(%rax),%rdx        ; map->dmat        (offset 0x18)
ffffffff80c19764: mov 0x48(%rdx),%rcx        ; dmat->bounce_zone(offset 0x48)
ffffffff80c19768: mov 0x10(%rax),%edx        ; map->pagesneeded (offset 0x10)
ffffffff80c1976b: sub 0x14(%rax),%edx        ; - map->pagesreserved
ffffffff80c1976e: mov 0x34(%rcx),%esi        ; bz->free_bpages  <-- FAULT (rcx==NULL)

=> the map popped from the waiting list was the FREED-and-clobbered chunk;
   its dmat field (attacker-influenced) led to a NULL bounce_zone.