I could easily reproduce this by running:
```
for i in $(seq 1 15); do cat /dev/dsp >/dev/null & cat /dev/random >/dev/dsp & done
```
and unplugging as quickly as possible. There is a short time window where this would cause a panic:
```
root@freebsd:~ # ./test
ugen0.4: <Focusrite Scarlett Solo USB> at usbus0 (disconnected)
uaudio0: at uhub0, port 1, addr 7 (disconnected)
cat: /dev/dsp: Device not configured
panic: ASan: Invalid access, 4-byte read at 0xfffffe005cb9645c, UMAUseAfterFree(fd)
cpuid = 1
time = 1713930201
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0xa5/frame 0xfffffe0046d4fad0
kdb_backtrace() at kdb_backtrace+0xc6/frame 0xfffffe0046d4fc30
vpanic() at vpanic+0x210/frame 0xfffffe0046d4fdd0
panic() at panic+0xb5/frame 0xfffffe0046d4fea0
kasan_code_name() at kasan_code_name/frame 0xfffffe0046d4ff70
dev_ref() at dev_ref+0x46/frame 0xfffffe0046d4ff90
devfs_lookup() at devfs_lookup+0x76c/frame 0xfffffe0046d502b0
vfs_lookup() at vfs_lookup+0x9bb/frame 0xfffffe0046d50530
namei() at namei+0x659/frame 0xfffffe0046d506b0
vn_open_cred() at vn_open_cred+0x33b/frame 0xfffffe0046d50a30
openatfp() at openatfp+0x52b/frame 0xfffffe0046d50c90
sys_openat() at sys_openat+0x81/frame 0xfffffe0046d50cd0
filemon_wrapper_openat() at filemon_wrapper_openat+0x19/frame 0xfffffe0046d50d10
amd64_syscall() at amd64_syscall+0x39e/frame 0xfffffe0046d50f30
fast_syscall_common() at fast_syscall_common+0xf8/frame 0xfffffe0046d50f30
--- syscall (499, FreeBSD ELF64, openat), rip = 0x3de8f7c0a6da, rsp = 0x3de8f4da2308, rbp = 0x3de8f4da23f0 ---
KDB: enter: panic
[ thread pid 1061 tid 100134 ]
Stopped at kdb_enter+0x34: movq $0,0x1f09d01(%rip)
db>
```