At present, g_slice_orphan and g_slice_spoiled destroy the softc
(struct g_slicer) even before calling g_wither_geom, so there can
be active and incoming io requests at that time and g_slice_start
can access the softc.
There are several ways to fix this problem.
I decided to use providergone callback to destroy the softc only after
all providers have detached. It would have been sufficient to wait
until the providers leave the doorstep (upon nend reaching nstart),
but there is no notification for that.