I appreciate the analysis in the bug report. Basically, before the fix, there was a possibility of use-after-reassign, because aio_copyout_result_port() must be called before the reqp parameters are marked for reuse by aio_req_free_port().
Did you do any performance testing? We're now holding the mutex for the additional time of aio_copyout_result_port(). It doesn't appear to be an inordinately long time, but I'm wondering if you noticed any performance changes after this fix?