STAILQ_REMOVE in devstat_remove_entry derefs NULL if node already absent

Summary

STAILQ_REMOVE(queue.h:324-329) walks to tail if elm absent. NULL deref -> panic. devstat_remove_entry no membership check. Double-remove/driver bug -> immediate panic. devstat_num_devs goes negative.