@@ -, +, @@ 
 Unread portion of the kernel message buffer:
 stack pointer	        = 0x28:0xfffffe01eba0a9e0
 frame pointer	        = 0x28:0xfffffe01eba0a9f0
 code segment		= base 0x0, limit 0xfffff, type 0x1b
 processor eflags	= interrupt enabled, resume, IOPL = 0
 current process	= 13 (g_event)
 trap number		= 12
 panic: page fault
 cpuid = 3
 KDB: stack backtrace:
 db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 0xfffffe01eba0a560
 vpanic() at vpanic+0x182/frame 0xfffffe01eba0a5e0
 panic() at panic+0x43/frame 0xfffffe01eba0a640
 trap_fatal() at trap_fatal+0x331/frame 0xfffffe01eba0a6a0
 trap_pfault() at trap_pfault+0x1e3/frame 0xfffffe01eba0a700
 trap() at trap+0x273/frame 0xfffffe01eba0a910
 calltrap() at calltrap+0x8/frame 0xfffffe01eba0a910
 --- trap 0xc, rip = 0xffffffff80500fde, rsp = 0xfffffe01eba0a9e0, rbp = 0xfffffe01eba0a9f0 ---
 g_dev_orphan() at g_dev_orphan+0x2e/frame 0xfffffe01eba0a9f0
 g_resize_provider_event() at g_resize_provider_event+0x71/frame 0xfffffe01eba0aa20
 g_run_events() at g_run_events+0x20e/frame 0xfffffe01eba0aa70
 fork_exit() at fork_exit+0x85/frame 0xfffffe01eba0aab0
 fork_trampoline() at fork_trampoline+0xe/frame 0xfffffe01eba0aab0
 --- trap 0, rip = 0, rsp = 0, rbp = 0 ---
 Uptime: 3h17m41s
 Dumping 1120 out of 8055 MB:..2%..12%..22%..32%..42%..52%..62%..72%..82%..92%
 Reading symbols from /usr/lib/debug/boot/kernel/zfs.ko.debug...done.
 [...]
 Loaded symbols for /usr/lib/debug/boot/kernel/iicbb.ko.debug
 #0  doadump (textdump=1) at pcpu.h:222
 222	pcpu.h: No such file or directory.
 	in pcpu.h
 (kgdb) where
 #0  doadump (textdump=1) at pcpu.h:222
 #1  0xffffffff805cce3e in kern_reboot (howto=260) at /usr/src/sys/kern/kern_shutdown.c:366
 #2  0xffffffff805cd40b in vpanic (fmt=<value optimized out>, ap=<value optimized out>) at /usr/src/sys/kern/kern_shutdown.c:759
 #3  0xffffffff805cd243 in panic (fmt=0x0) at /usr/src/sys/kern/kern_shutdown.c:690
 #4  0xffffffff808eece1 in trap_fatal (frame=0xfffffe01eba0a920, eva=8) at /usr/src/sys/amd64/amd64/trap.c:801
 #5  0xffffffff808eeed3 in trap_pfault (frame=0xfffffe01eba0a920, usermode=0) at /usr/src/sys/amd64/amd64/trap.c:658
 #6  0xffffffff808ee4d3 in trap (frame=0xfffffe01eba0a920) at /usr/src/sys/amd64/amd64/trap.c:421
 #7  0xffffffff808d2701 in calltrap () at /usr/src/sys/amd64/amd64/exception.S:236
 #8  0xffffffff80500fde in g_dev_orphan (cp=0xfffff800069e6280) at /usr/src/sys/geom/geom_dev.c:754
 #9  0xffffffff80509ff1 in g_resize_provider_event (arg=<value optimized out>, flag=<value optimized out>) at /usr/src/sys/geom/geom_subr.c:631
 #10 0xffffffff80504f1e in g_run_events () at /usr/src/sys/geom/geom_event.c:264
 #11 0xffffffff805830e5 in fork_exit (callout=0xffffffff805079c0 <g_event_procbody>, arg=0x0, frame=0xfffffe01eba0aac0) at /usr/src/sys/kern/kern_fork.c:1040
 #12 0xffffffff808d2c3e in fork_trampoline () at /usr/src/sys/amd64/amd64/exception.S:611
 #13 0x0000000000000000 in ?? ()
 Current language:  auto; currently minimal
 (kgdb) f 8
 #8  0xffffffff80500fde in g_dev_orphan (cp=0xfffff800069e6280) at /usr/src/sys/geom/geom_dev.c:754
 754		g_trace(G_T_TOPOLOGY, "g_dev_orphan(%p(%s))", cp, cp->geom->name);
 (kgdb) p cp
 $1 = (struct g_consumer *) 0xfffff800069e6280
 (kgdb) p cp->geom
 $2 = (struct g_geom *) 0xfffff801acd6d100
 (kgdb) p cp->geom->name
 $3 = 0xfffff8007479bf60 "cd0"
 (kgdb) f 8
 #8  0xffffffff80500fde in g_dev_orphan (cp=0xfffff800069e6280) at /usr/src/sys/geom/geom_dev.c:754
 754		g_trace(G_T_TOPOLOGY, "g_dev_orphan(%p(%s))", cp, cp->geom->name);
 (kgdb) l
 754		g_trace(G_T_TOPOLOGY, "g_dev_orphan(%p(%s))", cp, cp->geom->name);
 755
 756		/* Reset any dump-area set on this device */
 757		if (dev->si_flags & SI_DUMPDEV)
 758			(void)set_dumper(NULL, NULL, curthread);
 759
 760		/* Destroy the struct cdev *so we get no more requests */
 761		destroy_dev_sched_cb(dev, g_dev_callback, cp);
 762	}
 763
 (kgdb) p dev->si_flags
 Cannot access memory at address 0x8
 (kgdb) p dev
 $4 = (struct cdev *) 0x0
---
 sys/geom/geom_dev.c | 3 +++
 1 file changed, 3 insertions(+)
--- b/sys/geom/geom_dev.c	
+++ b/sys/geom/geom_dev.c	
@@ -753,6 +753,9 @@ g_dev_orphan(struct g_consumer *cp)
 	dev = sc->sc_dev;
 	g_trace(G_T_TOPOLOGY, "g_dev_orphan(%p(%s))", cp, cp->geom->name);
 
+	if (dev == NULL)
+		 return;
+
 	/* Reset any dump-area set on this device */
 	if (dev->si_flags & SI_DUMPDEV)
 		(void)set_dumper(NULL, NULL, curthread);
--