This is the first of two related changes, the second change making dying jails unresurrectable.
Currently, the state of a prison is deduced from its pr_ref and pr_uref counters, with three or four possible states:
pr_ref == 0: new (internal to kern_jail_set), or dead but not yet unlinked.
pr_ref > 0 && pr_uref > 0: alive, visible to kernel and user space
pr_ref > 0 && pr_uref == 0: dying, vidible to kernel but hidden from user space
The difference between the very beginning and end of a jail life cycle is subtle: both are linked into allprisons and pr_children, and are skipped when searching those lists. New prisons are referenced within kern_jail_set and given references to make them visible when the system call succeeds. Dead prisons are only linked into the lists when the last reference is dropped in a context that isn't known to support sleep locks.
This patch makes the jail state explicit, though it mostly follows the above model. The state may be one of the three already-defined constants in jail.h: PRISON_STATE_INVALID (new), PRISON_STATE_ALIVE, PRISON_STATE_DYING. The difference between ALIVE and DYING states is exactly as before: a prison is ALIVE when its pr_uref > 0. Fully dead jails are still deduced from pr_ref == 0, but new jails are not. With an explicit INVALID state, new jails can get a reference added at creation time, avoiding accidental removal coming from a ref being added and removed before the prison is fully created. I don't think there's a code path that does this, though it could possible happen in OSD modules.
Really though, this isn't intended as a standalone change, but part of a set. The next patch, removing the ability to "resurrect" a dying jail, relies on breaking the linkage between pr_uref and aliveness.