DF-5394 — kgdb session on crash dump #1 (run 2, /var/crash/vmcore.0, stock kernel)
===================================================================================
(gdb/kern.0/vmcore.0) bt:
#0  0xffffffff8065d664 in panic ()
#1  0xffffffff80bd5081 in trap_fatal ()
#2  0xffffffff80bd5661 in trap_pfault ()
#3  0xffffffff80bd5bcc in trap ()
#4  0xffffffff80b991fa in calltrap ()
#5  0xffffffff8068734a in _callout_cancel_or_stop ()
#6  0xffffffff80a60cdc in usb_detach ()            <- usb_controller.c:200
#7  0xffffffff8068e5a4 in device_detach ()
#8  0xffffffff8068e91b in device_delete_child ()
#9  0xffffffff8068ea48 in device_delete_children ()
#10 0xffffffff82605be0 in ?? ()                    <- xhci_pci_detach (module)

usb_detach disassembly (objdump -d kern.0):
  usb_detach+0x11:  callq device_get_softc
  usb_detach+0x16:  test %rax,%rax
  usb_detach+0x19:  je    usb_detach+0xc7          ; :195 NULL check -> early return
  usb_detach+0x1f:  mov   %rax,%rbx                ; bus
  usb_detach+0x22:  lea   0x490(%rax),%rdi         ; &bus->power_wdog  (offsetof=0x490)
  usb_detach+0x37:  callq callout_drain            ; :200 -> _callout_cancel_or_stop

trap frame (struct trapframe @ 0xfffff8011846d5e8, dump #1;
            @ 0xfffff8008e0b85e8, dump #2 — identical):
  tf_rbx     = 0xfffffffffffffff8   usb_detach's `bus`  (wild, non-NULL)
  tf_rdi     = 0x488                &bus->power_wdog = -8 + 0x490
  tf_addr    = 0x498                fault VA = 0x488 + 0x10
  tf_err     = 0x2                  supervisor WRITE
  tf_trapno  = 0xc                  page fault
  tf_rip     = 0xffffffff8068734a   _callout_cancel_or_stop+0x1a:
                                     lock andl $0xffffefff,0x10(%rdi)

usbus device object found in dump #1 @ 0xfffff80117958500:
  ivars  (+0x78) = 0xfffff801188e0528  == bus (matches intrhook warning
                                         "usb: func=0xffffffff80a60880
                                          arg=0xfffff801188e0528")
  softc  (+0x80) = 0xfffff801188e0528  == bus — the async :791
                                         device_set_softc() had landed in the
                                         device object the detach path is
                                         tearing down.