syzbot

panic: pool_p_free: rttmr free list modified: page 0xfffffd806c6b3000; item addr 0xfffffd806c6b3ef0; offset 0x10=0x8398d2e0
Starting stack trace...
panic(ffffffff833478d0) at panic+0x1ba sys/kern/subr_prf.c:229
pool_p_free(ffffffff838feda8,fffffd806c6b3f90) at pool_p_free+0x2d1 sys/kern/subr_pool.c:986
pool_reclaim(ffffffff838feda8) at pool_reclaim+0x2c2 sys/kern/subr_pool.c:1152
pool_reclaim_all() at pool_reclaim_all+0x48 sys/kern/subr_pool.c:-1
kern_sysctl(ffff80003c97b374,1,200000000180,ffff80003c97b3a8,200000001180,4,13f70b048cc7c83e) at kern_sysctl+0x1094 sys/kern/kern_sysctl.c:686
sys_sysctl(ffff80002a88c7f8,ffff80003c97b4d0,ffff80003c97b420) at sys_sysctl+0x3e5 sys/kern/kern_sysctl.c:-1
syscall(ffff80003c97b4d0) at syscall+0x962 mi_syscall sys/sys/syscall_mi.h:-1 [inline]
syscall(ffff80003c97b4d0) at syscall+0x962 sys/arch/amd64/amd64/trap.c:748
Xsyscall() at Xsyscall+0x128
end of kernel
end trace frame: 0x5b30d9d9090, count: 249
End of stack trace.