When a connection closes, the fidpool is destroyed before the conn is removed from srv->conns. np_fidpool_count walks srv->conns calling np_fidpool_count on each conn. Although the conns list is protected in both cases by srv->lock, the fidpool is destroyed without taking the lock. Just remove the conn from the srv->conns list before destroying the fidpool and this is fixed.
NOTE: This will break regression tests on some non-x86_64 architectures until they catch up with upstream kernel fs/9p.