Index: sys/cam/ata/ata_da.c
===================================================================
--- sys/cam/ata/ata_da.c
+++ sys/cam/ata/ata_da.c
@@ -3262,7 +3262,7 @@
 		return;
 	}
 	case ADA_CCB_DUMP:
-		/* No-op.  We're polling */
+		done_ccb->ccb_h.xflags |= CAM_CCB_DONE;
 		return;
 	default:
 		break;
Index: sys/cam/cam_ccb.h
===================================================================
--- sys/cam/cam_ccb.h
+++ sys/cam/cam_ccb.h
@@ -113,7 +113,8 @@
 typedef enum {
 	CAM_USER_DATA_ADDR	= 0x00000002,/* Userspace data pointers */
 	CAM_SG_FORMAT_IOVEC	= 0x00000004,/* iovec instead of busdma S/G*/
-	CAM_UNMAPPED_BUF	= 0x00000008 /* use unmapped I/O */
+	CAM_UNMAPPED_BUF	= 0x00000008,/* use unmapped I/O */
+	CAM_CCB_DONE            = 0x00000010,/* ccb memory can be safely freed or reused. */
 } ccb_xflags;
 
 /* XPT Opcodes for xpt_action */
Index: sys/cam/cam_xpt.c
===================================================================
--- sys/cam/cam_xpt.c
+++ sys/cam/cam_xpt.c
@@ -3073,9 +3073,15 @@
 	    (--timeout > 0)) {
 		mtx_unlock(&devq->send_mtx);
 		DELAY(100);
-		CAM_SIM_LOCK(sim);
-		(*(sim->sim_poll))(sim);
-		CAM_SIM_UNLOCK(sim);
+		/*
+		 * We may dump with a running scheduler (via "reboot -d"). In
+		 * such a case, polling is neither safe nor necessary.
+		 */
+		if (SCHEDULER_STOPPED()) {
+			CAM_SIM_LOCK(sim);
+			(*(sim->sim_poll))(sim);
+			CAM_SIM_UNLOCK(sim);
+		}
 		camisr_runqueue();
 		mtx_lock(&devq->send_mtx);
 	}
@@ -3085,12 +3091,13 @@
 	if (timeout != 0) {
 		xpt_action(start_ccb);
 		while(--timeout > 0) {
-			CAM_SIM_LOCK(sim);
-			(*(sim->sim_poll))(sim);
-			CAM_SIM_UNLOCK(sim);
+			if (SCHEDULER_STOPPED()) {
+				CAM_SIM_LOCK(sim);
+				(*(sim->sim_poll))(sim);
+				CAM_SIM_UNLOCK(sim);
+			}
 			camisr_runqueue();
-			if ((start_ccb->ccb_h.status  & CAM_STATUS_MASK)
-			    != CAM_REQ_INPROG)
+			if (start_ccb->ccb_h.xflags & CAM_CCB_DONE)
 				break;
 			DELAY(100);
 		}
Index: sys/cam/nvme/nvme_da.c
===================================================================
--- sys/cam/nvme/nvme_da.c
+++ sys/cam/nvme/nvme_da.c
@@ -1053,7 +1053,7 @@
 		return;
 	}
 	case NDA_CCB_DUMP:
-		/* No-op.  We're polling */
+		done_ccb->ccb_h.xflags |= CAM_CCB_DONE;
 		return;
 	default:
 		break;
Index: sys/cam/scsi/scsi_da.c
===================================================================
--- sys/cam/scsi/scsi_da.c
+++ sys/cam/scsi/scsi_da.c
@@ -5177,7 +5177,7 @@
 		return;
 	}
 	case DA_CCB_DUMP:
-		/* No-op.  We're polling */
+		done_ccb->ccb_h.xflags |= CAM_CCB_DONE;
 		return;
 	case DA_CCB_TUR:
 	{