kern/57149: panic with core dump when disconnect usb keyboard

[nervoso%k1.com.br@localhost]

>Number:         57149
>Category:       kern
>Synopsis:       panic with core dump when disconnect usb keyboard
>Confidential:   no
>Severity:       serious
>Priority:       high
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Fri Dec 30 06:35:00 +0000 2022
>Originator:     sergio lenzi
>Release:        10.0_BETA
>Organization:
k1 sistemas
>Environment:
NetBSD V10.netbsd 10.0_BETA NetBSD 10.0_BETA (GENERIC) #0: Thu Dec 29 18:48:40 -03 2022  NetBSD@V10.netbsd:/home/NetBSD/BUILD/10/amd64/OBJ/sys/arch/amd64/compile/GENERIC amd64
>Description:
very stable system, but panics when disconnect usb keyboard, tested in several computers kernel core and kernel available at http://www.k1.com.br/NetBSD/10/amd64/crash
full message:


crash -M netbsd.0.core -N netbsd.0
Crash version 10.0_BETA, image version 10.0_BETA.
crash: _kvm_kvatop(0)
Kernel compiled without options LOCKDEBUG.
System panicked: kernel diagnostic assertion "c->c_magic == CALLOUT_MAGIC" failed: file "/home/NetBSD/BUILD/10/usr/src/sys/kern/kern_timeout.c", line 547 
Backtrace from time of crash is available.
crash> bt
vmx_insn_failinvalid() at 0
kern_reboot() at sys_reboot
vpanic() at vpanic+0x188
kern_assert() at __x86_indirect_thunk_rax
callout_halt() at callout_halt+0x160
ukbd_detach() at ukbd_detach+0x52
config_detach() at config_detach+0x1bc
config_detach_children() at config_detach_children+0x57
uhidev_detach() at uhidev_detach+0x28
config_detach() at config_detach+0x1bc
usb_disconnect_port() at usb_disconnect_port+0xc3
uhub_explore() at uhub_explore+0x378
usb_discover() at usb_discover+0x4f
usb_event_thread() at usb_event_thread+0x7a
crash> 

>How-To-Repeat:
boot the system, with a USB keyboard, than unplug de device... the system dumps core on swap device 
>Fix: