The OSMO_ASSERT(msg->list.next != LLIST_POISON1) are checking msgb which has been removed from the llist. All llist members which aren't part of a list have LLIST_POISON1 assigned.
These OSMO_ASSERT()s will always trigger this msgb.
Fixes: a684bc4e38b4 ("Make ch9 usb tests work") Change-Id: I49c81fba756f3620638b6c6c664f53e4a8758ef9
