kn_status is protected by the kqueue's lock, but we were updating it
without the kqueue lock held. For EVFILT_TIMER knotes, there is no
knlist lock, so the knote activation could occur during the kn_status
update following event registration. The activation should enqueue the
knote and set KN_QUEUED, but I have a test case where the KN_QUEUED flag
gets lost, leading to corruption of the queue.
Fix the problem by setting or clearing KN_DISABLED before dropping the
kqueue lock to call into the filter. KN_DISABLED is only used by the
core kevent code, so there is no side effect from setting it earlier.