Took a stab at debugging this. It happens (sometimes) during SMB service shutdown.
080448f8 libc.so.1`_assert_c99(fd19ce3a, fd19cae0, 2be, fef70cec)
08044928 libshare_smb.so.1`smb_smf_scf_init+0x191(fd19cfbb)
08044d68 libshare_smb.so.1`smb_config_getstr+0x56(17, 8044dc0, 200)
08044d98 libshare_smb.so.1`smb_config_get+0x47(17, 8044dc0, 200)
08044fd8 libshare_smb.so.1`smb_load_proto_properties+0x80()
08044fe8 libshare_smb.so.1`smb_share_init+0x38()
080455b8 libshare.so.1`proto_plugin_init+0x318()
08046698 libshare.so.1`sa_init_impl+0x6f(1, 0)
080466b8 libshare.so.1`sa_init+0x10(1)
080466d8 libmlsvc.so.1`smb_shr_sa_enter+0x9b()
08047d38 libmlsvc.so.1`smb_shr_unload+0x1c()
08047d58 smbd_service_fini+0x4c()
08047da8 main+0x2af(8047dac, fef585c8)
08047de8 _start_crt+0x96(2, 8047e14, fefd0c9c, 0, 0, 0)
08047e08 _start+0x1a(2, 8047ed8, 8047eed, 0, 8047ef3, 8047f0e)
For some reason, at this point we cannot get a libshare handle.
Specifically, the call to scf_handle_bind() fails, here:
http://src.illumos.org/source/xref/illumos-gate/usr/src/lib/smbsrv/libsmb/common/smb_scfutil.c?r=a90cf9f2#655
The error is SCF_ERROR_NO_SERVER, which (I guess) means the svc.configd has already stopped?
Probably something changed about tear-down order to break this.
The smb_shr_unload() function was added in #11025 so this started at some point after that went in.