Delayed kernel panic caused by the deferred-callback machinery writing into
the FREED bus_dmamap chunk (add_bounce_page's STAILQ_INSERT_TAIL(&map->bpages,
bpage, links) writes bpages.stqh_first at offset 0 of the freed 72-byte chunk,
which is where kern_slaballoc threads its free-chunk list).  The corruption
was planted by PoC run 2 (destroy-while-queued, chunk NOT reclaimed); the
panic fired during the NEXT unrelated kmalloc(72) in bus_dmamap_create:

panic: assertion "(((intptr_t)chunk ^ (intptr_t)z) & ZoneMask) == 0" failed in chunk_mark_allocated at /usr/src/sys/kern/kern_slaballoc.c:1659
cpuid = 0
Trace beginning at frame 0xfffff801185bd6d8
chunk_mark_allocated() at chunk_mark_allocated+0x8a 0xffffffff80655e4a
chunk_mark_allocated() at chunk_mark_allocated+0x8a 0xffffffff80655e4a
_kmalloc() at _kmalloc+0x684 0xffffffff80657444
bus_dmamap_create() at bus_dmamap_create+0x4c 0xffffffff80c1acbc
busdmauaf_handler() at busdmauaf_handler+0x1b7 0xffffffff82600207
module_register_init() at module_register_init+0x49 0xffffffff806232e9
Debugger("panic")

(reproduced twice, identical stack, on two separate boots)