kern/48212: modunload(8) for nfsserver leaves a dangling callout scheduled

[paul%whooppee.com@localhost]

>Number:         48212
>Category:       kern
>Synopsis:       modunload(8) for nfsserver leaves a dangling callout scheduled
>Confidential:   no
>Severity:       serious
>Priority:       high
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sat Sep 14 22:35:00 +0000 2013
>Originator:     Paul Goyette
>Release:        NetBSD 6.99.23
>Organization:
-------------------------------------------------------------------------
| Paul Goyette     | PGP Key fingerprint:     | E-mail addresses:       |
| Customer Service | FA29 0E3B 35AF E8AE 6651 | paul at whooppee.com    |
| Network Engineer | 0786 F758 55DE 53BA 7731 | pgoyette at juniper.net |
| Kernel Developer |                          | pgoyette at netbsd.org  |
-------------------------------------------------------------------------
>Environment:
System: NetBSD screamer.whooppee.com 6.99.23 NetBSD 6.99.23 (GENERIC) #17: Thu 
Jul 4 07:18:10 PDT 2013 
paul%screamer.whooppee.com@localhost:/build/netbsd-local/obj/amd64/sys/arch/amd64/compile/GENERIC
 amd64
Architecture: x86_64
Machine: amd64
>Description:
Shortly after running modunload on the nfsserver module, the machine
crashes with the following traceback:

fatal pagefault in supervisor mode
trap type 6 code 0 rip ffffffff801fc780 cs8 rflags 10283 cr2 8 ilevel 2 rsp 
fffffe800100bc10
curlwp 0xfffffe811fb38860 pid 0.5 lowest kstack 0xfffffe8001009000
kernel: pagefault trap. code = 0
Stopped in pid 0.5 (system) at netbsd:mutex_vector_enter+0x91: movq 
18(%r15),%rax

>How-To-Repeat:
1. Boot a modular kernel, in which neither the nfs nor nfsserver modules
   are built-in
2. Load the nfs module with modload(8)
3. Load nfsserver module
4. Unload the nfsserver module with modunload(8)

After a short wait, an nfs timer will fire, and it will attempt to invoke
nfsserver code which no longer exists.

This is with modules built from sources updated on 2013-09-14 at 19:08:50 UTC
>Fix:
Unknown