Add calls to callout_drain() to ensure the callouts are flushed before

we free memory from underneath them.

This fixes an occasional panic I've been seeing in softclock() where a bad
pointer would be encountered when pushing DTrace hard.

sys/cddl/contrib/opensolaris/uts/common/dtrace/dtrace.c

@@ -13616,7 +13616,9 @@ dtrace_state_destroy(dtrace_state_t *state)
 		cyclic_remove(state->dts_deadman);
 #else
 	callout_stop(&state->dts_cleaner);
+	callout_drain(&state->dts_cleaner);
 	callout_stop(&state->dts_deadman);
+	callout_drain(&state->dts_deadman);
 #endif
 
 	dtrace_dstate_fini(&vstate->dtvs_dynvars);