iSCSI initiator panic on abrupt reconnect during in-flight write (kern/297019)

Dear Sirs,

   I just filed kern/297019 with a panic + backtrace + source-level 
analysis suggesting the iSCSI initiator can dereference stale write-data 
pages after an abrupt (ping-timeout-triggered) reconnect, if a 
retransmit of that write is still queued or in flight at the moment 
scsi_session_terminate_task() completes the CCB. CTL's target-side 
session-termination path (cfiscsi_session_terminate_tasks()) already 
waits for the analogous condition before proceeding 
(cs_outstanding_ctl_pdus); the initiator side doesn't have an 
equivalent, as far as I can find.

Confirmed the same code paths are present, unchanged, on releng/15.1 as 
well as the 14.4 branch the original panic occurred on -- details
and full backtrace in the PR.

I tried a simple code to add a per-task reference count, but can't 
confirm yet if the bug (the panic) is solved, as i cannot try it on real 
production servers.

Happy to provide any more data, or answer questions about the production 
context this was found in.

Thank you and best regards

Loic