Why would you crash is you have device mapper multipath configured to handle
path fail over? We have tons of enterprise customers that use that...

cf http://www.spinics.net/lists/linux-scsi/msg56254.html

Basically hot unplug of an sdX can oops on any recent kernel, no
matter what dm stuff you have on top.

On the broader topic of error handling and so on, I do agree that is always
an area of concern (how many times to retry, how long time outs need to be,
when to panic/reboot or propagate up an error code)

Yes, especially the scsi eh stuff escalating to a host reset when
a single drive has gone bad -- even if the HBA is happily doing IO
to other drives, we'll kill access to the whole SAS fabric.

- R.