panic: handle_workitem_remove: directory ino ADDR negative i_nlink -NUM

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 0ded4647215c vtnet.4: update description of loader tunables
git tree: freebsd-src
console output: https://syzkaller.appspot.com/x/log.txt?x=17778cf0580000
dashboard link: https://syzkaller.appspot.com/bug?extid=fbfff9613b6dab616124

Unfortunately, I don't have any reproducer for this issue yet.

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+fbfff9...@syzkaller.appspotmail.com

panic: handle_workitem_remove: directory ino 198645 negative i_nlink -1
cpuid = 0
time = 12
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0xc6/frame 0xfffffe0056c4b7d0
kdb_backtrace() at kdb_backtrace+0xd0/frame 0xfffffe0056c4b930
vpanic() at vpanic+0x257/frame 0xfffffe0056c4baf0
panic() at panic+0xb5/frame 0xfffffe0056c4bbb0
handle_workitem_remove() at handle_workitem_remove+0xd72/frame 0xfffffe0056c4bcf0
process_worklist_item() at process_worklist_item+0x525/frame 0xfffffe0056c4be40
softdep_process_worklist() at softdep_process_worklist+0xfd/frame 0xfffffe0056c4be90
softdep_flush() at softdep_flush+0x1a4/frame 0xfffffe0056c4bef0
fork_exit() at fork_exit+0xcc/frame 0xfffffe0056c4bf30
fork_trampoline() at fork_trampoline+0xe/frame 0xfffffe0056c4bf30
--- trap 0, rip = 0, rsp = 0, rbp = 0 ---
KDB: enter: panic
[ thread pid 14 tid 100094 ]
Stopped at kdb_enter+0x6e: movq $0,0x25c45c7(%rip)
db>
db> set $lines = 0
db>


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup