illumos gate

I see the following panic when removing a log device from a pool on OmniOS, using the latest openzfs sources (7c31fbc1417cbf353f32d946c0ddba71fce1757a 18-May-2016). The panic does not happen on FreeBSD/head or on a version of OpenZFS from around January (I don't know the exact revision number)

1. zpool create foo c2t2d0 log c2t3d0
2. zpool remove foo c2t3d0

1. mdb 5
   Loading modules: [ unix genunix specfs dtrace mac cpu.generic uppc apix scsi_vhci zfs sata sd ip hook neti sockfs arp usba uhci stmf stmf_sbd mm lofs random idm nfs ptm ]

::status

debugging crash dump vmcore.5 (64-bit) from alans-omnios-stable
operating system: 5.11 SunOS_Development (i86pc)
image uuid: 1587869d-6069-e8f9-a8cd-962ca1e7492e
panic message:
BAD TRAP: type=e (#pf Page fault) rp=ffffff001f79a8b0 addr=10 occurred in module "
zfs" due to a NULL pointer dereference
dump content: kernel pages only

$C

ffffff001f79a9d0 metaslab_group_histogram_verify+0x83(ffffff07131c3440)
ffffff001f79aa30 vdev_remove+0xbe(ffffff071764c800, 7ad)
ffffff001f79aa90 vdev_sync+0x1a3(ffffff071764c800, 7ad)
ffffff001f79ab50 spa_sync+0x2cb(ffffff0713475000, 7ad)
ffffff001f79ac20 txg_sync_thread+0x260(ffffff0715693ec0)
ffffff001f79ac30 thread_start+8()