A "umount -f /dev" will trigger this. https://people.freebsd.org/~pho/stress/log/devfs4.txt
A commit references this bug: Author: pho Date: Tue Feb 5 08:15:20 UTC 2019 New revision: 343768 URL: https://svnweb.freebsd.org/changeset/base/343768 Log: PR: 235513 Sponsored by: Dell EMC Isilon Changes: user/pho/stress2/misc/devfs4.sh
Peter added a test-case but that doesn't fix the underlying problem.
It looks like we already claim to support forcible devfs unmount, mostly for jails it seems. This particular panic is from a longstanding KASSERT, so at least the case of INVARIANTS + devfs forced unmount hasn't been well tested. I'll poke at this and see if I can tease out some useful fix. Probably not, given the foot-shooting nature of the problem, but at least I might learn something about the buffer cache.