panic: supervisor write data, protection violation (vn_read/copyout_smap_erms?)

Hi,

The latest FreeBSD 16-CURRENT panics during some disk activities
(e.g.: installing a packages, starting some services, for example
/etc/rc.d/devd)

--
Fatal trap 12: page fault while in kernel mode
cpuid = 6; apic id = 06
fault virtual address   = 0x45e4db029e00
fault code              = supervisor write data, protection violation
instruction pointer     = 0x20:0xffffffff81127826
stack pointer           = 0x28:0xfffffe00ff03b930
frame pointer           = 0x28:0xfffffe00ff03b930
code segment            = base 0x0, limit 0xfffff, type 0x1b
                       = DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags        = interrupt enabled, resume, IOPL = 0
current process         = 1042 (sh)
rdi: 000045e4db029e00 rsi: fffff80063fed000 rdx: 0000000000000400
rcx: 0000000000000400  r8: fffff80063fed000  r9: 000000000000261f
rax: 0000000000000000 rbx: fffff80063fed000 rbp: fffffe00ff03b930
r10: 0000000000000400 r11: fffff8000fb9ccd0 r12: fffffe00ff03bde8
r13: 0000000000000400 r14: 0000000000000400 r15: fffffe00ff03bda8
trap number             = 12
panic: page fault
cpuid = 6
time = 1773492421
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 0xfffffe00ff03b640
vpanic() at vpanic+0x136/frame 0xfffffe00ff03b770
panic() at panic+0x43/frame 0xfffffe00ff03b7d0
trap_fatal() at trap_fatal+0x68/frame 0xfffffe00ff03b7f0
trap_pfault() at trap_pfault+0x2ac/frame 0xfffffe00ff03b860
calltrap() at calltrap+0x8/frame 0xfffffe00ff03b860
--- trap 0xc, rip = 0xffffffff81127826, rsp = 0xfffffe00ff03b930, rbp
= 0xfffffe00ff03b930 ---
copyout_smap_erms() at copyout_smap_erms+0x196/frame 0xfffffe00ff03b930
uiomove_fromphys() at uiomove_fromphys+0x15f/frame 0xfffffe00ff03b990
vn_read_from_obj() at vn_read_from_obj+0x13f/frame 0xfffffe00ff03ba70
VOP_READ_PGCACHE_APV() at VOP_READ_PGCACHE_APV+0x2a/frame 0xfffffe00ff03ba90
vn_read() at vn_read+0x94/frame 0xfffffe00ff03bb10
vn_io_fault_doio() at vn_io_fault_doio+0x45/frame 0xfffffe00ff03bb70
vn_io_fault1() at vn_io_fault1+0x15e/frame 0xfffffe00ff03bcb0
vn_io_fault() at vn_io_fault+0x19d/frame 0xfffffe00ff03bd40
dofileread() at dofileread+0x80/frame 0xfffffe00ff03bd90
sys_read() at sys_read+0x127/frame 0xfffffe00ff03be00
amd64_syscall() at amd64_syscall+0x169/frame 0xfffffe00ff03bf30
fast_syscall_common() at fast_syscall_common+0xf8/frame 0xfffffe00ff03bf30
--- syscall (3, FreeBSD ELF64, read), rip = 0x3e8c57b7232a, rsp =
0x3e8c53973298, rbp = 0x3e8c539732e0 ---
KDB: enter: panic
Uptime: 17s
--

Other info + messages in dmesg:

Kernel: GENERIC

uname -a:

FreeBSD host1.my.domain 16.0-CURRENT FreeBSD 16.0-CURRENT #0
main-f91464171d61: Sat Mar 14 12:35:27 UTC 2026
[email protected]:/usr/obj/usr/jails/src/src_16/src/amd64.amd64/sys/GENERIC
amd64

Filesystem: UFS2

dmesg with suspicious entries:
```
lock order reversal: (sleepable after non-sleepable)
1st 0xffffffff81da28a8 dev mtx (devd, sleep mutex) @
/usr/jails/src/src_16/src/sys/kern/kern_devctl.c:572
2nd 0xffffffff82300d50 umareclaim (umareclaim, sx) @
/usr/jails/src/src_16/src/sys/vm/uma_core.c:3428
lock order devd -> umareclaim attempted at:
#0 0xffffffff80c43fbf at witness_checkorder+0xcaf
#1 0xffffffff80bd40f0 at _sx_xlock+0x60
#2 0xffffffff80f9903d at uma_zdestroy+0x3d
#3 0xffffffff80b64fce at sysctl_devctl_queue+0x8e
#4 0xffffffff80bdb3ec at sysctl_root_handler_locked+0x9c
#5 0xffffffff80bda74f at sysctl_root+0x22f
#6 0xffffffff80bdae56 at userland_sysctl+0x1b6
#7 0xffffffff80bdac65 at sys___sysctl+0x65
#8 0xffffffff8112b719 at amd64_syscall+0x169
#9 0xffffffff810fa54b at fast_syscall_common+0xf8
Freed UMA keg (DEVCTL) was not empty (455 items).  Lost 114 pages of memory.
```