I'm not fully sure if this is correct (as in, should we be checking SCHEDULER_STOPPED instead?) My use case is I had a panic because of a use-after-free where a callout was freed while it was still scheduled and the system panicked when the callout was finally executed. However, that panic occurred with the callout_mtx lock held and so the pretimeout here then recursively panicked since the lock was already held so I could not get a dump (also couldn't reboot, but that's a different problem). It seems to me what when we pat the watchdog during the loop in doadump() we should only be patting existing watchdogs and not messing with any other state. Possibly we shouldn't be doing the softtimer stuff either in that case, only invoking the eventhandlers and returning.