Re: kern/60531: looping "vflushbuf: dirty" message

Found another path to reassignbuf called without the vnode lock, this
time for a VREG vnode instead of VBLK -- this one is definitely
snapshot-related (presumably the vnode is the snapshot backing store,
since it's marked VV_SYSTEM), and could cause the vflushbuf warning
message and/or almost unbounded running time for the vflushbuf loop
(really, bounded by the file system size; once the whole fs is backed
up, there won't be any more writes to it):

# mount
/dev/dk1 on / type ffs (log, local)
ptyfs on /dev/pts type ptyfs (local)
tmpfs on /tmp type tmpfs (local)
tmpfs on /var/run type tmpfs (local)
tmpfs on /var/shm type tmpfs (local)
/dev/vio9p0 on /mnt type puffs|9p
/dev/ld4a on /mnt type ffs (local)
# dump -X -0ant -f - / | gzip -nc >/mnt/var/tmp/dump.0
  [20:10:11 UTC] DUMP: Found /dev/rdk1 on / in /etc/fstab
  [20:10:11 UTC] DUMP: Date of this level 0 dump: Sun Aug  2 20:10:11 2026
  [20:10:11 UTC] DUMP: Date of last level 0 dump: the epoch
  [20:10:11 UTC] DUMP: Dumping a snapshot of /dev/rdk1 (/) to standard outp=
ut
  [20:10:11 UTC] DUMP: Label: none
  [20:10:13 UTC] DUMP: mapping (Pass I) [regular files]
  [20:10:19 UTC] DUMP: mapping (Pass II) [directories]
  [20:10:19 UTC] DUMP: estimated 3140383 tape blocks.
  [20:10:19 UTC] DUMP: Volume 1 started at: Sun Aug  2 20:10:19 2026
  [20:10:19 UTC] DUMP: dumping (Pass III) [directories]
[ 479.4390328] panic: kernel diagnostic assertion "vp->v_type =3D=3D VBLK |=
| VOP_ISLOCKED(vp)" failed: file "/home/riastradh/netbsd/current/src/sys/ke=
rn/vfs_subr.c", line 562 vp=3D0xffff00007cf02800 state=3D3
[ 479.4577654] cpu0: Begin traceback...
[ 479.4577654] trace fp ffffc000c63c78f0
[ 479.4790797] fp ffffc000c63c7920 vpanic() at ffffc0000061f864 netbsd:vpan=
ic+0x1bc
[ 479.5110599] fp ffffc000c63c7980 kern_assert() at ffffc000008c6958 netbsd=
:kern_assert+0x58
[ 479.5425878] fp ffffc000c63c7a10 reassignbuf() at ffffc00000686434 netbsd=
:reassignbuf+0x2d4
[ 479.5740262] fp ffffc000c63c7a40 bdwrite() at ffffc000006743e8 netbsd:bdw=
rite+0x128
[ 479.5961369] fp ffffc000c63c7a70 ffs_balloc() at ffffc0000053c240 netbsd:=
ffs_balloc+0x15e0
[ 479.6380279] fp ffffc000c63c7bd0 wrsnapblk() at ffffc000005401c4 netbsd:w=
rsnapblk+0x44
[ 479.6800518] fp ffffc000c63c7c10 ffs_copyonwrite() at ffffc00000540b50 ne=
tbsd:ffs_copyonwrite+0x1a4
[ 479.7140520] fp ffffc000c63c7ca0 fscow_run() at ffffc0000069236c netbsd:f=
scow_run+0xbc
[ 479.7349917] fp ffffc000c63c7ce0 bread() at ffffc00000676278 netbsd:bread=
+0x58
[ 479.7680479] fp ffffc000c63c7d10 ffs_update() at ffffc0000053ed94 netbsd:=
ffs_update+0x128
[ 479.8000553] fp ffffc000c63c7d70 ffs_sync() at ffffc00000548ae8 netbsd:ff=
s_sync+0x1e8
[ 479.8209946] fp ffffc000c63c7df0 VFS_SYNC() at ffffc000006874e4 netbsd:VF=
S_SYNC+0x24
[ 479.8540963] fp ffffc000c63c7e20 sched_sync() at ffffc00000687670 netbsd:=
sched_sync+0x110
[ 479.8860508] tf ffffc000c63c7ed0 el0_trap() at ffffc000000c0ff0 netbsd:el=
1_trap_exit+0x68
[ 479.8960548] cpu0: End traceback...
Stopped in pid 0.124 (system) at        netbsd:cpu_Debugger+0xc:        ldp
x29, x30, [sp],#16
db{0}> show vnode ffff00007cf02800
OBJECT 0xffff00007cf02800: locked=3D0, pgops=3D0xffffc00000aebb48, npages=
=3D0, refs=3D1

vnode 0xffff00007cf02800 flags 0x12<SYSTEM,MPSAFE>
tag VT_UFS(1) type VREG(1) mount 0xffff00007daf2000 typedata 0x0
usecount 1 writecount 0 holdcount 410
size f9c00050 writesize f9c00050 numoutput 0
data 0xffff00007d0d94c0 lock 0xffff00007cf02a80
state LOADED key(0xffff00007daf2000 8) 67 1f 00 00 00 00 00 00
lrulisthd 0xffffc00001265e10
db{0}> call vprint(0,ffff00007cf02800)
vnode 0xffff00007cf02800 flags 0x12<SYSTEM,MPSAFE>
[ 479.8960548]  tag VT_UFS(1) type VREG(1) mount 0xffff00007daf2000 typedat=
a 0x0
[ 479.8960548]  usecount 1 writecount 0 holdcount 410
[ 479.8960548]  size f9c00050 writesize f9c00050 numoutput 0
[ 479.8960548]  data 0xffff00007d0d94c0 lock 0xffff00007cf02a80
[ 479.8960548]  state LOADED key(0xffff00007daf2000 8) 67 1f 00 00 00 00 00=
 00
[ 479.8960548]  lrulisthd 0xffffc00001265e10
[ 479.8960548]  tag VT_UFS, ino 8039, on dev 168, 1 flags 0x6, nlink 0
[ 479.8960548]  mode 0100600, owner 0, group 0, size 4190109776
0