When a disk disappears and the periph is invalidated, any I/Os that are pending with the controller can cause a crash when they complete. This diff holds the softc reference count taken in dastart() until the I/O is complete rather than only until xpt_action() returns. (This approach was suggested by Ken Merry.)
Note that the ada and nda drivers likely need similar changes, this addresses only the da driver since that's all I can test so far.