procdesc: postpone freeing the zombie' pid until procdesc is freed

Requested by:	asomers
Reviewed by:	asomers, markj
Tested by:	pho
Sponsored by:	The FreeBSD Foundation
MFC after:	1 week
Differential revision:	https://reviews.freebsd.org/D54592

sys/kern/kern_exit.c

@@ -979,10 +979,10 @@ proc_reap(struct thread *td, struct proc *p, int *status, int options)
 	leavepgrp(p);
 	if (p->p_procdesc != NULL)
 		procdesc_reap(p);
+	else
+		proc_id_clear(PROC_ID_PID, p->p_pid);
 	sx_xunlock(&proctree_lock);
 
-	proc_id_clear(PROC_ID_PID, p->p_pid);
-
 	PROC_LOCK(p);
 	knlist_detach(p->p_klist);
 	p->p_klist = NULL;

sys/kern/sys_procdesc.c

@@ -270,6 +270,9 @@ procdesc_free(struct procdesc *pd)
 		KASSERT((pd->pd_flags & PDF_CLOSED),
 		    ("procdesc_free: !PDF_CLOSED"));
 
+		if (pd->pd_pid != -1)
+			proc_id_clear(PROC_ID_PID, pd->pd_pid);
+
 		knlist_destroy(&pd->pd_selinfo.si_note);
 		PROCDESC_LOCK_DESTROY(pd);
 		free(pd, M_PROCDESC);
@@ -389,6 +392,7 @@ procdesc_close(struct file *fp, struct thread *td)
 			 */
 			pd->pd_proc = NULL;
 			p->p_procdesc = NULL;
+			pd->pd_pid = -1;
 			procdesc_free(pd);
 
 			/*