mutex_oncpu() called on destroyed mutex? (was: repeated panics in mutex_vector_enter (from unp_thread))

[Edgar Fuß]

I observe this on 6.1, but I can't see the relevant code changed in current.

mutex_vector_enter() does (-current uses KPREMPT_* macros)

        do {
                kpreempt_enable();
                SPINLOCK_BACKOFF(count);
                kpreempt_disable();
                owner = mtx->mtx_owner;
        } while (mutex_oncpu(owner));

and my problem seems to be owner == MUTEX_THREAD (i.e. the mutex destroyed) 
the time mutex_oncpu(owner) is called.

My understanding of locking is limited (close to zero) but why shouldn't 
the mutex in question be destroyed during the preemption-enabled period?

I must be missing something.