I think calling c:assign is too ugly solution..
assign dismount: internally calls RemDosEntry() which is as simple as:
dl = DeviceNode head
struct DosList *dl2 = BADDR(dl->dol_Next);
if(dl2 == dlist)
dl->dol_Next = dlist->dol_Next;
dl = dl2;
(Forbid state required of course)
You should first find the correct device node and then exit the loop because doslist may have changed and "DeviceNode = (struct DeviceNode *)BADDR(DeviceNode->dn_Next) ;" may access random memory.
It is not safe to scan doslist without forbid state. (and forbid in this code would be broken anyway during packet calls)
But I don't think this is the cause for crash.