I have seen indications of a similar bug.
In my case, it has been 'vref used where vget required' on
NetBSD-1.4.2, tending to happen when I do a 'cfs mkm'.  I think the
crash happens when that item in the minicache gets freed/flushed.

My ideas are

  some sort of log of all operations on cfs0 that can be examined
  post-mortem

  implement some stronger invariant checking that can verify the vnode
  refcounts

  put in recovery code for these cases that can adjust refcounts
  rather than panicing, and seeing what the pattern of errors is
  [dangerous and risks some corruption, but might provide useful insight]

  a thorough code review of the kernel code with explicit
  documentation of all the reference-counting rules and any other
  invariants

I won't claim that any of these are easy.
  
        Greg Troxel <gdt_at_ir.bbn.com>