panic: mtx_lock() of destroyed mutex at sys/kern/sys_socket.c:LINE

[syzbot]

Hello,

syzbot found the following crash on:

HEAD commit: fbc304aa Bind TCP HPTS (pacer) threads to NUMA domains
git tree: freebsd
console output: https://syzkaller.appspot.com/x/log.txt?x=1743e48ca00000
dashboard link: https://syzkaller.appspot.com/bug?extid=30fce14a2fbd4c66648f
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=17bf24d8a00000

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+30fce1...@syzkaller.appspotmail.com

panic: mtx_lock() of destroyed mutex @
/syzkaller/managers/main/kernel/sys/kern/sys_socket.c:309
cpuid = 0
time = 1557505974
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0x47/frame
0xfffffe001fa9f6d0
vpanic() at vpanic+0x1e0/frame 0xfffffe001fa9f730
panic() at panic+0x43/frame 0xfffffe001fa9f790
__mtx_lock_flags() at __mtx_lock_flags+0x1e2/frame 0xfffffe001fa9f7f0
soo_stat() at soo_stat+0x9c/frame 0xfffffe001fa9f830
kern_fstat() at kern_fstat+0xe9/frame 0xfffffe001fa9f880
sys_fstat() at sys_fstat+0x2b/frame 0xfffffe001fa9f980
amd64_syscall() at amd64_syscall+0x436/frame 0xfffffe001fa9fab0
fast_syscall_common() at fast_syscall_common+0x101/frame 0xfffffe001fa9fab0
--- syscall (198, FreeBSD ELF64, nosys), rip = 0x41309a, rsp =
0x7fffdff79f38, rbp = 0x2 ---
KDB: enter: panic
[ thread pid 893 tid 100411 ]
Stopped at kdb_enter+0x6a: movq $0,kdb_why
db>


---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this bug, for details see:
https://goo.gl/tpsmEJ#testing-patches