ng_socket refcount bug?

Hi,

I pretty consistently see a panic running if_pppoe tests.
These tests use `/usr/libexec/pppoed -l pppoe-pap epair0b` (or similar) 
to be a PPPoE server in one vnet (so that I can test if_pppoe in another 
vnet).

Unfortunately I can’t share the if_pppoe module required to run them.

They reliably panic like this:

	panic: ng node  won't die
	cpuid = 39
	time = 1781899222
	KDB: stack backtrace:
	db_trace_self_wrapper() at db_trace_self_wrapper+0x36/frame 
0xfffffe004ac1cb40
	vpanic() at vpanic+0x149/frame 0xfffffe004ac1cc70
	panic() at panic+0x43/frame 0xfffffe004ac1ccd0
	vnet_netgraph_uninit() at vnet_netgraph_uninit+0x171/frame 
0xfffffe004ac1cd00
	vnet_destroy() at vnet_destroy+0x154/frame 0xfffffe004ac1cd30
	prison_deref() at prison_deref+0xb15/frame 0xfffffe004ac1cdb0
	sys_jail_remove() at sys_jail_remove+0x1a7/frame 0xfffffe004ac1cdf0
	amd64_syscall() at amd64_syscall+0x179/frame 0xfffffe004ac1cf30
	fast_syscall_common() at fast_syscall_common+0xf8/frame 
0xfffffe004ac1cf30
	--- syscall (508, FreeBSD ELF64, jail_remove), rip = 0xfe32964660a, rsp 
= 0xfe324ddabb8, rbp = 0xfe324ddac40 ---
	KDB: enter: panic
	[ thread pid 17271 tid 102985 ]
	Stopped at      kdb_enter+0x33: movq    $0,0x15abeb2(%rip)

This patch avoids the problem for me, but I don’t actually understand 
why. To the extent that I understand the reference counting done in the 
relevant code it looks correct to me.

	diff --git a/sys/netgraph/ng_socket.c b/sys/netgraph/ng_socket.c
	index c570584d4b44..685ad1e892d0 100644
	--- a/sys/netgraph/ng_socket.c
	+++ b/sys/netgraph/ng_socket.c
	@@ -1102,7 +1102,6 @@ ngs_shutdown(node_p node)
	        if (pcbp != NULL)
	                soisdisconnected(pcbp->ng_socket);

	-       priv->node = NULL;
	        NG_NODE_SET_PRIVATE(node, NULL);
	        ng_socket_free_priv(priv);

Does this sound familiar to anyone?

Thanks,
Kristof