Index: sys/kern/subr_trap.c
===================================================================
--- sys/kern/subr_trap.c	(revision 242183)
+++ sys/kern/subr_trap.c	(working copy)
@@ -145,6 +145,11 @@ userret(struct thread *td, struct trapframe *frame
 
 	/*
 	 * Check for misbehavior.
+	 *
+	 * In case there is a callchain tracing ongoing because of
+	 * hwpmc(4), skip the scheduler pinning check.
+	 * hwpmc(4) subsystem, infact, will collect callchain informations
+	 * at ast() checkpoint, which is past userret().
 	 */
 	WITNESS_WARN(WARN_PANIC, NULL, "userret: returning");
 	KASSERT(td->td_critnest == 0,
@@ -155,7 +160,7 @@ userret(struct thread *td, struct trapframe *frame
 	    ("userret: Returning with pagefaults disabled"));
 	KASSERT((td->td_pflags & TDP_NOSLEEPING) == 0,
 	    ("userret: Returning with sleep disabled"));
-	KASSERT(td->td_pinned == 0,
+	KASSERT(td->td_pinned == 0 || (td->td_pflags & TDP_CALLCHAIN) != 0,
 	    ("userret: Returning with with pinned thread"));
 	KASSERT(td->td_vp_reserv == 0,
 	    ("userret: Returning while holding vnode reservation"));
Index: sys/dev/hwpmc/hwpmc_mod.c
===================================================================
--- sys/dev/hwpmc/hwpmc_mod.c	(revision 242183)
+++ sys/dev/hwpmc/hwpmc_mod.c	(working copy)
@@ -4248,7 +4248,7 @@ pmc_capture_user_callchain(int cpu, int ring, stru
 	    ("[pmc,%d] cpu %d didn't find a sample to collect", __LINE__,
 		cpu));
 
-	KASSERT(td->td_pinned > 0,
+	KASSERT(td->td_pinned == 1,
 	    ("[pmc,%d] invalid td_pinned value", __LINE__));
 	sched_unpin();	/* Can migrate safely now. */