Still ULE+PREEMPTION
I have done several experiments/asserts to ensure that the panic is related to ULE+PREEMPTION case only.
ULE: no panic
4BSD: no panic
4BSD+PREEMPTION: no panic
My latest progress is that I found that sched_switch in ULE for the threaded case, can decide whether subsequent call would panic. Investigating.