Use after free in devfs from new pts

With memguard watching the DEVFS1 malloc type:

kern.pts.enable: 0 -> 1

running the pty stress2 test gives:

Fatal trap 12: page fault while in kernel mode
cpuid = 1; apic id = 06
fault virtual address   = 0xc9448070
fault code              = supervisor write, protection violation
instruction pointer     = 0x20:0xc050fb1a
stack pointer           = 0x28:0xf7cefa6c
frame pointer           = 0x28:0xf7cefa80
code segment            = base 0x0, limit 0xfffff, type 0x1b
                        = DPL 0, pres 1, def32 1, gran 1
processor eflags        = interrupt enabled, resume, IOPL = 0
current process         = 1159 (pty)
[thread pid 1159 tid 100212 ]
Stopped at      dev_relthread+0x33:     subl    $0x1,0x70(%ebx)
db> wh
Tracing pid 1159 tid 100212 td 0xccc5ad80
dev_relthread(c9448000,3,2000,ccc5ad80,c9448000) at dev_relthread+0x33
devfs_close(f7cefaec,c07607e6,3,3,ce23ca80) at devfs_close+0x3a6
VOP_CLOSE_APV(c0774ea0,f7cefaec,ccc5ad80,ccc5ad80,cc7b9000) at VOP_CLOSE_APV+0x94
vn_close(ce23ca80,3,ccb63b80,ccc5ad80,c106cc08) at vn_close+0xb0
vn_closefile(cce8fe10,ccc5ad80,f7cefbac,c051ab9d,cce8fe10) at vn_closefile+0xf0
devfs_close_f(cce8fe10,ccc5ad80,c0737913,876,cce8fe10) at devfs_close_f+0x19
fdrop_locked(cce8fe10,ccc5ad80,c0737913,861) at fdrop_locked+0xb9
fdrop(cce8fe10,ccc5ad80,cc483928,0,c0737913,872,cce8fe10,ccc5ad80,f7cefc0c,c051aade,0,ccc5ad80,c0737913,861,0,f7cefc40,c056d352,ccc9602c,ccc9602c,3f8,c0737913,f7cefc48,c05341e6,ccc9602c,1,c073a278,138) at fdrop+0x3c
closef(cce8fe10,ccc5ad80,c0737913,3f8,ccc5ad80) at closef+0x428
close(ccc5ad80,f7cefd04,4,445,ccc5ad80) at close+0x25b
syscall(3b,3b,3b,28050a1a,bfbfe880) at syscall+0x307
Xint0x80_syscall() at Xint0x80_syscall+0x1f
--- syscall (6, FreeBSD ELF32, close), eip = 0x28160a23, esp = 0xbfbfe81c, ebp = 0xbfbfea88 ---

Kris