The vdev_copy_uberblocks() function uses abd_to_buf(ub_abd)) but allocates it with abd_alloc(VDEV_UBERBLOCK_SIZE(vd), B_TRUE):
https://github.com/zfsonlinux/zfs/blob/39f56627ae988d09b4e3803c01c22b2026b2310e/module/zfs/vdev_label.c#L1167
https://github.com/zfsonlinux/zfs/blob/39f56627ae988d09b4e3803c01c22b2026b2310e/module/zfs/vdev_label.c#L1179
When the vd's ashift is high, VDEV_UBERBLOCK_SIZE(vd) can be larger than PAGESIZE, which causes abd_alloc() to return a scattered ABD, which will panic abd_to_buf(ub_abd)).