A "umount -f /dev" will trigger this.
A commit references this bug:
Date: Tue Feb 5 08:15:20 UTC 2019
New revision: 343768
Sponsored by: Dell EMC Isilon
Peter added a test-case but that doesn't fix the underlying problem.
It looks like we already claim to support forcible devfs unmount, mostly for jails it seems. This particular panic is from a longstanding KASSERT, so at least the case of INVARIANTS + devfs forced unmount hasn't been well tested.
I'll poke at this and see if I can tease out some useful fix. Probably not, given the foot-shooting nature of the problem, but at least I might learn something about the buffer cache.