panic in daprobedone: Unholding 4 with cnt = 0

I've started to hit this panic with USB mass storage, before even the 
device has become in-use:

panic: Unholding 4 with cnt = 0

Backtrace:

vpanic()
panic()
daprobedone()
dadone()
xpt_done_process()
xpt_done_td()
fork_exit()
fork_trampoline()

db>


> static inline void
> da_periph_unhold(struct cam_periph *periph, da_ref_token token)
> {
>         int cnt;
>         struct da_softc *softc = periph->softc;
> 
>         token_sanity(token);
>         DA_PERIPH_PRINT(periph, "Unholding device %s (%d)\n",
>             da_ref_text[token], token);
>         cnt = atomic_fetchadd_int(&softc->ref_flags[token], -1);
>         if (cnt != 1)
>                 panic("Unholding %d with cnt = %d", token, cnt);
>         cam_periph_unhold(periph);
> }