umount -f /dev causes "panic: vput: negative ref cnt"

umount -f /dev causes this panic shortly thereafter:

panic: vput: negative ref cnt
at line 2064 in file ../../../kern/vfs_subr.c
Debugger("panic")
Stopped at      Debugger+0x54:  xchgl   %ebx,in_Debugger.0
db> trace
Debugger(c076a7f5,c07d5e00,810,c077277d,100) at Debugger+0x54
__panic(c077277d,810,c0772b07,7ec,c07a733c) at __panic+0xf5
vput(c59ddb2c,ffffffdf,c4d45580,0,c6a79bd0) at vput+0x21c
stat(c6a79bd0,d9494d14,c078733d,3e2,2) at stat+0xa7
syscall(2f,2f,2f,28163580,bfbfe490) at syscall+0x2a0
Xint0x80_syscall() at Xint0x80_syscall+0x1d
--- syscall (188, FreeBSD ELF32, stat), eip = 0x280d2d7f, esp = 0xbfbfde5c, ebp = 0xbfbfe288 ---
db>