There are evidences that list entry taken from scp_rqbd_idle in ptlrpc_service_purge_all() is used then being freed. From code that entry is taken from the list without any protection, so that is possible place when it is being freed at the same time.

I wasn't able to reproduce that but it seems that is only place where it can happen and solution would be just take the same spinlock svcpt->scp_lock which is used in all other place where these rqbd_list linkage is being used