Reproducer:
```
# kldload snd_dummy # or an actual sound card
# sysctl hw.snd.maxautovchans=50 # even the default can trigger it
# for i in $(seq 1 50); do cat /dev/random >/dev/dsp & done
# kldunload snd_dummy
Kernel page fault with the following non-sleepable locks held:
exclusive sleep mutex cdev (cdev) r = 0 (0xffffffff8301dd00) locked @ /mnt/src/sys/kern/kern_conf.c:72
stack backtrace:
#0 0xffffffff811c97bf at witness_debugger+0x13f
#1 0xffffffff811cb344 at witness_warn+0x674
#2 0xffffffff81a212c6 at trap_pfault+0x116
#3 0xffffffff81a2023c at trap+0x54c
#4 0xffffffff819dc7d8 at calltrap+0x8
#5 0xffffffff8101d97c at destroy_dev_tq+0x1bc
#6 0xffffffff811b256f at taskqueue_run_locked+0x1ff
#7 0xffffffff811b4258 at taskqueue_thread_loop+0x138
#8 0xffffffff81060e93 at fork_exit+0xa3
#9 0xffffffff819dd83e at fork_trampoline+0xe
Fatal trap 12: page fault while in kernel mode
cpuid = 1; apic id = 01
fault virtual address = 0xffffffff841e99b8
fault code = supervisor read data, page not present
instruction pointer = 0x20:0xffffffff8101a40b
stack pointer = 0x28:0xfffffe0046a16c20
frame pointer = 0x28:0xfffffe0046a16d00
code segment = base 0x0, limit 0xfffff, type 0x1b
= DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags = interrupt enabled, resume, IOPL = 0
current process = 0 (thread taskq)
rdi: ffffffff841e99b8 rsi: 0000000000000008 rdx: ffffffff81fbbbe0
rcx: 0000000000000000 r8: 0000000000000000 r9: 0000000000000001
rax: 0000003ff083d337 rbx: fffffe004a539c00 rbp: fffffe0046a16d00
r10: 0000000000000000 r11: 0000000000000002 r12: ffffffff841e99b8
r13: fffffe004a539e50 r14: fffffe004a539c60 r15: fffffe004a539c68
trap number = 12
panic: page fault
cpuid = 1
time = 1727629918
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0xa5/frame 0xfffffe0046a16390
kdb_backtrace() at kdb_backtrace+0xc6/frame 0xfffffe0046a164f0
vpanic() at vpanic+0x226/frame 0xfffffe0046a16690
panic() at panic+0xb5/frame 0xfffffe0046a16750
trap_fatal() at trap_fatal+0x65b/frame 0xfffffe0046a16850
trap_pfault() at trap_pfault+0x12b/frame 0xfffffe0046a16970
trap() at trap+0x54c/frame 0xfffffe0046a16b50
calltrap() at calltrap+0x8/frame 0xfffffe0046a16b50
--- trap 0xc, rip = 0xffffffff8101a40b, rsp = 0xfffffe0046a16c20, rbp = 0xfffffe0046a16d00 ---
destroy_devl() at destroy_devl+0x6eb/frame 0xfffffe0046a16d00
destroy_dev_tq() at destroy_dev_tq+0x1bc/frame 0xfffffe0046a16d50
taskqueue_run_locked() at taskqueue_run_locked+0x1ff/frame 0xfffffe0046a16eb0
taskqueue_thread_loop() at taskqueue_thread_loop+0x138/frame 0xfffffe0046a16ef0
fork_exit() at fork_exit+0xa3/frame 0xfffffe0046a16f30
fork_trampoline() at fork_trampoline+0xe/frame 0xfffffe0046a16f30
--- trap 0, rip = 0, rsp = 0, rbp = 0 ---
KDB: enter: panic
[ thread pid 0 tid 100014 ]
Stopped at kdb_enter+0x34: movq $0,0x1f09b11(%rip)
db>
```