uname -a

NetBSD h97 10.99.4 NetBSD 10.99.4
  (GENERIC-no-SYNAPTICS-nvmm-pmf-debug) #0: Sat May 27 16:15:46 JST 2023
  root@h97:/tmp/O/sys/arch/amd64/compile/GENERIC-no-SYNAPTICS-nvmm-pmf-debug
  amd64

panics twice at the same location:
(while running perl check-update)

Jun 16 05:00:30 h97 /netbsd: [ 1093164.9830786] panic: kernel
	diagnostic assertion "c->c_cpu->cc_lwp == curlwp ||
	c->c_cpu->cc_active != c" failed: file
	"/export/git-work/src/sys/kern/kern_timeout.c", line 381 running
	callout 0xffffa145a9530980: c_func (0xffffffff80ded3a7) c_flags
	(0x100) destroyed from 0xffffffff80e393f9
Jun 16 05:00:30 h97 /netbsd: [ 1093164.9830786] cpu1: Begin traceback...
Jun 16 05:00:30 h97 /netbsd: [ 1093164.9830786] vpanic() at netbsd:vpanic+0x173
Jun 16 05:00:30 h97 /netbsd: [ 1093164.9830786] kern_assert() at netbsd:kern_assert+0x4b
Jun 16 05:00:30 h97 /netbsd: [ 1093164.9830786] callout_destroy() at netbsd:callout_destroy+0xa2
Jun 16 05:00:30 h97 /netbsd: [ 1093164.9830786] timerfd_fop_close() at netbsd:timerfd_fop_close+0x36
Jun 16 05:00:30 h97 /netbsd: [ 1093164.9830786] closef() at netbsd:closef+0xa3
Jun 16 05:00:30 h97 /netbsd: [ 1093164.9830786] fd_close() at netbsd:fd_close+0x145
Jun 16 05:00:30 h97 /netbsd: [ 1093164.9830786] sys_close() at netbsd:sys_close+0x22
Jun 16 05:00:30 h97 /netbsd: [ 1093164.9830786] syscall() at netbsd:syscall+0x196
Jun 16 05:00:30 h97 /netbsd: [ 1093164.9830786] --- syscall (number 6) ---
Jun 16 05:00:30 h97 /netbsd: [ 1093164.9830786] netbsd:syscall+0x196:
Jun 16 05:00:30 h97 /netbsd: [ 1093164.9830786] cpu1: End traceback...
Jun 16 05:00:30 h97 /netbsd: 

Jun 17 12:14:55 h97 /netbsd: [ 112108.9087909] panic: kernel
   diagnostic assertion "c->c_cpu->cc_lwp == curlwp ||
   c->c_cpu->cc_active != c" failed: file "/export/git-work/src/sys/kern/kern_timeout.c",
   line 381 running callout 0xffffec165d9c00c0:
   c_func (0xffffffff80ded3a7) c_flags (0x100) destroyed from
   0xffffffff80e393f9

Jun 17 12:14:55 h97 /netbsd: [ 112108.9087909] cpu1: Begin traceback...
Jun 17 12:14:55 h97 /netbsd: [ 112108.9087909] vpanic() at netbsd:vpanic+0x173
Jun 17 12:14:55 h97 /netbsd: [ 112108.9087909] kern_assert() at netbsd:kern_assert+0x4b
Jun 17 12:14:55 h97 /netbsd: [ 112108.9087909] callout_destroy() at netbsd:callout_destroy+0xa2
Jun 17 12:14:55 h97 /netbsd: [ 112108.9087909] timerfd_fop_close() at netbsd:timerfd_fop_close+0x36
Jun 17 12:14:55 h97 /netbsd: [ 112108.9087909] closef() at netbsd:closef+0xa3
Jun 17 12:14:55 h97 /netbsd: [ 112108.9087909] fd_close() at netbsd:fd_close+0x145
Jun 17 12:14:55 h97 /netbsd: [ 112108.9087909] sys_close() at netbsd:sys_close+0x22
Jun 17 12:14:55 h97 /netbsd: [ 112108.9087909] syscall() at netbsd:syscall+0x196
Jun 17 12:14:55 h97 /netbsd: [ 112108.9087909] --- syscall (number 6) ---
Jun 17 12:14:55 h97 /netbsd: [ 112108.9087909] netbsd:syscall+0x196:
Jun 17 12:14:55 h97 /netbsd: [ 112108.9087909] cpu1: End traceback...
Jun 17 12:14:55 h97 /netbsd: 
Jun 17 12:14:55 h97 /netbsd: [ 112108.9087909] dumping to dev 0,1 (offset=7380303, size=5226262):
Jun 17 12:14:55 h97 /netbsd: [ 112108.9087909] dump <4>coretemp1: workqueue busy: updates stopped
Jun 17 12:14:55 h97 /netbsd: [ 112140.0184784] coretemp2: workqueue busy: updates stopped

view +381 /export/git-work/src/sys/kern/kern_timeout.c

  363 void
  364 callout_destroy(callout_t *cs)
  365 {
  366         callout_impl_t *c = (callout_impl_t *)cs;
  367
  368         SDT_PROBE1(sdt, kernel, callout, destroy,  cs);
  369
  370         KASSERTMSG(c->c_magic == CALLOUT_MAGIC,
  371             "callout %p: c_magic (%#x) != CALLOUT_MAGIC (%#x)",
  372             c, c->c_magic, CALLOUT_MAGIC);
  373         /*
  374          * It's not necessary to lock in order to see the correct value
  375          * of c->c_flags.  If the callout could potentially have been
  376          * running, the current thread should have stopped it.
  377          */
  378         KASSERTMSG((c->c_flags & CALLOUT_PENDING) == 0,
  379             "pending callout %p: c_func (%p) c_flags (%#x) destroyed from %p",
  380             c, c->c_func, c->c_flags, __builtin_return_address(0));
  381         KASSERTMSG(c->c_cpu->cc_lwp == curlwp || c->c_cpu->cc_active != c,
  382             "running callout %p: c_func (%p) c_flags (%#x) destroyed from %p",
  383             c, c->c_func, c->c_flags, __builtin_return_address(0));
  384         c->c_magic = 0;
  385 }

objdump -d /netbsd |less

ffffffff80e393c3 <timerfd_fop_close>:
ffffffff80e393c3:       55                      push   %rbp
ffffffff80e393c4:       48 89 e5                mov    %rsp,%rbp
ffffffff80e393c7:       41 54                   push   %r12
ffffffff80e393c9:       48 83 ec 08             sub    $0x8,%rsp
ffffffff80e393cd:       4c 8b 67 18             mov    0x18(%rdi),%r12
ffffffff80e393d1:       48 c7 47 18 00 00 00    movq   $0x0,0x18(%rdi)
ffffffff80e393d8:       00 
ffffffff80e393d9:       49 83 bc 24 e8 00 00    cmpq   $0x0,0xe8(%r12)
ffffffff80e393e0:       00 00 
ffffffff80e393e2:       75 46                   jne    ffffffff80e3942a <timerfd_fop_close+0x67>
ffffffff80e393e4:       e8 9a 45 fb ff          callq  ffffffff80ded983 <itimer_lock>
ffffffff80e393e9:       4c 89 e7                mov    %r12,%rdi
ffffffff80e393ec:       e8 a0 51 fb ff          callq  ffffffff80dee591 <itimer_poison>
ffffffff80e393f1:       4c 89 e7                mov    %r12,%rdi
ffffffff80e393f4:       e8 ba 52 fb ff          callq  ffffffff80dee6b3 <itimer_fini>
ffffffff80e393f9:       49 8d bc 24 98 00 00    lea    0x98(%r12),%rdi
ffffffff80e39400:       00 
ffffffff80e39401:       e8 00 26 f6 ff          callq  ffffffff80d9ba06 <cv_destroy>
ffffffff80e39406:       49 8d bc 24 a8 00 00    lea    0xa8(%r12),%rdi
ffffffff80e3940d:       00 
ffffffff80e3940e:       e8 2a c9 ff ff          callq  ffffffff80e35d3d <seldestroy>
ffffffff80e39413:       be 28 01 00 00          mov    $0x128,%esi
ffffffff80e39418:       4c 89 e7                mov    %r12,%rdi
ffffffff80e3941b:       e8 2a 1f fd ff          callq  ffffffff80e0b34a <kmem_free>
ffffffff80e39420:       31 c0                   xor    %eax,%eax
ffffffff80e39422:       48 83 c4 08             add    $0x8,%rsp
ffffffff80e39426:       41 5c                   pop    %r12
ffffffff80e39428:       5d                      pop    %rbp
ffffffff80e39429:       c3                      retq   
ffffffff80e3942a:       41 b8 bc 00 00 00       mov    $0xbc,%r8d
ffffffff80e39430:       48 c7 c1 98 0e 4d 81    mov    $0xffffffff814d0e98,%rcx
ffffffff80e39437:       48 c7 c2 3d 0f 4d 81    mov    $0xffffffff814d0f3d,%rdx
ffffffff80e3943e:       48 c7 c6 93 a3 39 81    mov    $0xffffffff8139a393,%rsi
ffffffff80e39445:       48 c7 c7 18 a4 39 81    mov    $0xffffffff8139a418,%rdi
ffffffff80e3944c:       31 c0                   xor    %eax,%eax
ffffffff80e3944e:       e8 f1 e1 1a 00          callq  ffffffff80fe7644 <kern_assert>
ffffffff80e39453:       eb 8f                   jmp    ffffffff80e393e4 <timerfd_fop_close+0x21>

view /export/git-work/src/sys/kern/sys_timerfd.c

    379 static int
    380 timerfd_fop_close(file_t * const fp)
    381 {
    382         struct timerfd * const tfd = fp->f_timerfd;
    383 
    384         fp->f_timerfd = NULL;
    385         timerfd_destroy(tfd);
    386 
    387         return 0;
    388 }