11.1-RC1 kernel panic (zfs recv)

[John Kennedy]

I've had a kernel crash with 3 different RC1 kernels.

kernel: FreeBSD 11.1-RC1 #71 r313908+b08656c3ba28(releng/11.1): Sun Jul  2 23:15:23 PDT 2017
kernel: FreeBSD 11.1-RC1 #72 r313908+64e0abde4c70(releng/11.1): Mon Jul  3 07:43:42 PDT 2017
kernel: FreeBSD 11.1-RC1 #73 r313908+ff3a058c4f83(releng/11.1): Mon Jul  3 11:56:29 PDT 2017

# kldstat
Id Refs Address            Size     Name
 1   42 0xffffffff80200000 1f67128  kernel
 2    1 0xffffffff82169000 3161c0   zfs.ko
 3    2 0xffffffff82480000 c9e8     opensolaris.ko
 4    1 0xffffffff8248d000 21c68    geom_eli.ko
 5    1 0xffffffff824af000 bc68     aesni.ko
 6    1 0xffffffff824bb000 114f58   nvidia-modeset.ko
 7    3 0xffffffff825d0000 ab7f8    linux.ko
 8    3 0xffffffff8267c000 ddc0     linux_common.ko
 9    2 0xffffffff8268a000 1056708  nvidia.ko
10    1 0xffffffff83821000 3602     ums.ko
11    1 0xffffffff83825000 3c35c    linux64.ko
12    1 0xffffffff83862000 eb0d     iscsi.ko

Excuse human-induced typos in stack-trace:

panic: avl_find() succeeded inside avl_add()
cpuid=5
KDB: stack backgrace:
#0 0xffffffff80aad9c7 at kdb_backtrace+0x67
#1 0xffffffff80a6baa6 at vpanic+0x186
#2 0xffffffff80a6b913 at panic+0x43
#3 0xffffffff82169df4 at avl_add+0x134
#4 0xffffffff821a9bed at dmu_recv_end+0x16d
#5 0xffffffff82231e0f at zfs_ioc_recv+0xb1f
#6 0xffffffff82233c36 at zfsdev_ioctl+0x6d6
#7 0xffffffff8093ad38 at devfs_ioctl_f+0x128
#8 0xffffffff80ac9315 at kern_ioctl+0x255
#9 0xffffffff80ac904f at sys_ioctl+0x16f
#10 0xffffffff80ee0394 at amd64_syscall+0x6c4
#11 0xffffffff80ec35cb at Xfast_syscall+0xfb

It is reproducible.  Initially saw it with zfs send | zfs recv (kernel #71),
reproduced outside of X so I could see the panic, installed kernel #72 to be
more current (had it compiled but not installed since I was doing lots of I/O).
Didn't happen with zfs send to file, happened on zfs recv from file, grabbed
#73 since it looked like it might apply since I have a da* via ISCSI, and
can still reproduce the problem.