kqueue bug in 7.x with "things" that go away.

I've run into a bug in kqueue/tty in 7.x.

How to reproduce:
open a tty, eg: a usb ftdi ucom device (ttyU0)
put a read event on it.  sleep in kevent
physically remove usb device
observe dmesg to say ucom0 went away.  Note sleeping program doesn't 
wake up.
ctrl-C (or otherwise exit the program sleeping in kevent)
panic!  0xdeadc0de reference or worse.

There are probably other ways to make it go boom, but this is pretty 
graphic.

The stack trace I have is a mess due to inlined static function calls, 
but here are the relevant parts:

#7  0xffffffff8042d77e in calltrap () 
at ../../../amd64/amd64/exception.S:169
#8  0xffffffff802a1645 in knlist_remove_kq (knl=0xdeadc0dedeadc1ae,
    kn=0xffffff0003bc5b40, knlislocked=0, kqislocked=0)
    at ../../../kern/kern_event.c:1608
#9  0xffffffff802a41fe in kqueue_close (fp=0xffffff0003d90528,
    td=0xffffff000e5c29c0) at ../../../kern/kern_event.c:1463
#10 0xffffffff8029c3cc in fdrop (fp=0xffffff0003d90528, 
td=0xffffff000e5c29c0)
    at file.h:297
#11 0xffffffff8029d7fb in closef (fp=0xffffff0003d90528, 
td=0xffffff000e5c29c0)
    at ../../../kern/kern_descrip.c:1983
#12 0xffffffff8029e32d in fdfree (td=0xffffff000e5c29c0)
    at ../../../kern/kern_descrip.c:1693
#13 0xffffffff802a70cc in exit1 (td=0xffffff000e5c29c0, rv=2)
---Type <return> to continue, or q <return> to quit---
    at ../../../kern/kern_exit.c:272
#14 0xffffffff802c651f in sigexit (td=0xffffff000e5c29c0, sig=0)
    at ../../../kern/kern_sig.c:2884
#15 0xffffffff802c7378 in postsig (sig=-559038034)
    at ../../../kern/kern_sig.c:2756
#16 0xffffffff802f4519 in ast (framep=0xffffffffabfe8c70)
    at ../../../kern/subr_trap.c:259
#17 0xffffffff8042d970 in Xfast_syscall ()
    at ../../../amd64/amd64/exception.S:286

Unfortunately, you don't see the inlined function calls in the trace.  
I'm not 100% sure what frame 8 and 9 are.

The kqueue filter functions dont seem to check TS_GONE.
-- 
Peter Wemm - peter_at_wemm.org; peter_at_FreeBSD.org; peter_at_yahoo-inc.com
"All of this is for nothing if we don't go to the stars" - JMS/B5