OS-3342+co

*** 2250,2259 ****
--- 2250,2261 ----
  }
  
  static void
  zone_free(zone_t *zone)
  {
+         zone_dl_t *zdl;
+ 
          ASSERT(zone != global_zone);
          ASSERT(zone->zone_ntasks == 0);
          ASSERT(zone->zone_nlwps == 0);
          ASSERT(zone->zone_nprocs == 0);
          ASSERT(zone->zone_cred_ref == 0);
*** 2278,2287 ****
--- 2280,2302 ----
          }
  
          list_destroy(&zone->zone_ref_list);
          zone_free_zsd(zone);
          zone_free_datasets(zone);
+ 
+         /*
+          * While dlmgmtd should have removed all of these, it could have left
+          * something behind or crashed. In which case it's not safe for us to
+          * assume that the list is empty which list_destroy() will ASSERT. We
+          * clean up for our userland comrades which may have crashed, or worse,
+          * been disabled by SMF.
+          */
+         while ((zdl = list_remove_head(&zone->zone_dl_list)) != NULL) {
+                 if (zdl->zdl_net != NULL)
+                         nvlist_free(zdl->zdl_net);
+                 kmem_free(zdl, sizeof (zone_dl_t));
+         }
          list_destroy(&zone->zone_dl_list);
  
          if (zone->zone_rootvp != NULL)
                  VN_RELE(zone->zone_rootvp);
          if (zone->zone_rootpath)