Finally nailed this sucker.

con_close() checks the tty->count and then sleeps in acquire_console_sem().
But another process can come in and grab a ref against the tty while
con_close() dropped the BKL.  But con_close() then proceeds to deallocate the
tty->driver_data anyway, even though the tty now has ->count == 2.

Fix that by moving the check for ->tty_count inside console_sem.