Hmm, I was trying for some time but for some reason the problem does not reproduce for me when I run the VM from your image on my test host. Not sure why is that. I've also looked into the code and the refcounting of blkg's inside BFQ looks rather straightforward and I didn't find any problem there. Any chance for triggering a crashdump when the problem happens so that we can poke around memory?