Ok, the fix has been committed to HEAD. This time for sure.
Please retest w/ the latest.
Basically it turned out to be a vgone*() recursion. allocfreevnode()
vgone*()'s the vnode it is trying to recycle. That called into HAMMER's
hammer_vop_inactive() which then called vrecycle() and recursively
called vgone*() again. As the recursion returned the vnode will have
already been destroyed/reused and it was being modified after the
fact.
-Matt