I uploaded a new debug kernel to the ppa:
https://launchpad.net/~ddstreet/+archive/ubuntu/lp1711407

I've only updated the 4.13 kernel currently, on Artful, so if you need a Xenial HWE 4.13 kernel let me know and I can build that as well.  It will likely take hours to finish building but should be ready tomorrow.

With the debug kernel, when you hit the bug, you should see additional debug output, like:

[   87.028053] unregister_netdevice: waiting for lo (netns ffff9af471fa8000) to become free. Usage count = 1
[   87.031461] 	(netns ffff9af471fa8000): open sk ffff9af479983000 family 16 state 7 dst_cache           (null) rx_dst           (null) creator __netlink_kernel_create+0x6c/0x260
[   87.031464] 	(netns ffff9af471fa8000): open sk ffff9af479982000 family 16 state 7 dst_cache           (null) rx_dst           (null) creator __netlink_kernel_create+0x6c/0x260
[   87.031467] 	(netns ffff9af471fa8000): open sk ffff9af479982800 family 16 state 7 dst_cache           (null) rx_dst           (null) creator __netlink_kernel_create+0x6c/0x260
[   87.031470] 	(netns ffff9af471fa8000): open sk ffff9af479985000 family 16 state 7 dst_cache           (null) rx_dst           (null) creator __netlink_kernel_create+0x6c/0x260
[   87.031475] 	(netns ffff9af471fa8000): open sk ffff9af476541540 family 2 state 7 dst_cache           (null) rx_dst           (null) creator inet_ctl_sock_create+0x37/0x80
[   87.031479] 	(netns ffff9af471fa8000): open sk ffff9af471096940 family 2 state 7 dst_cache           (null) rx_dst           (null) creator inet_ctl_sock_create+0x37/0x80
[   87.031482] 	(netns ffff9af471fa8000): open sk ffff9af471094f00 family 2 state 7 dst_cache           (null) rx_dst           (null) creator inet_ctl_sock_create+0x37/0x80
[   87.031485] 	(netns ffff9af471fa8000): open sk ffff9af4710970c0 family 2 state 7 dst_cache           (null) rx_dst           (null) creator inet_ctl_sock_create+0x37/0x80
[   87.031488] 	(netns ffff9af471fa8000): open sk ffff9af471094000 family 2 state 7 dst_cache           (null) rx_dst           (null) creator inet_ctl_sock_create+0x37/0x80
[   87.031491] 	(netns ffff9af471fa8000): open sk ffff9af4710961c0 family 2 state 7 dst_cache           (null) rx_dst           (null) creator inet_ctl_sock_create+0x37/0x80
[   87.031494] 	(netns ffff9af471fa8000): open sk ffff9af471095680 family 2 state 7 dst_cache           (null) rx_dst           (null) creator inet_ctl_sock_create+0x37/0x80
[   87.031497] 	(netns ffff9af471fa8000): open sk ffff9af471096580 family 2 state 7 dst_cache           (null) rx_dst           (null) creator inet_ctl_sock_create+0x37/0x80
[   87.031501] 	(netns ffff9af471fa8000): open sk ffff9af4710943c0 family 2 state 7 dst_cache           (null) rx_dst           (null) creator inet_ctl_sock_create+0x37/0x80
[   87.031504] 	(netns ffff9af471fa8000): open sk ffff9af479987000 family 16 state 7 dst_cache           (null) rx_dst           (null) creator __netlink_kernel_create+0x6c/0x260
[   87.031507] 	(netns ffff9af471fa8000): open sk ffff9af479981800 family 16 state 7 dst_cache           (null) rx_dst           (null) creator __netlink_kernel_create+0x6c/0x260
[   87.031510] 	(netns ffff9af471fa8000): open sk ffff9af475703f00 family 10 state 7 dst_cache           (null) rx_dst           (null) creator inet_ctl_sock_create+0x37/0x80
[   87.031513] 	(netns ffff9af471fa8000): open sk ffff9af475704380 family 10 state 7 dst_cache           (null) rx_dst           (null) creator inet_ctl_sock_create+0x37/0x80
[   87.031516] 	(netns ffff9af471fa8000): open sk ffff9af475707080 family 10 state 7 dst_cache           (null) rx_dst           (null) creator inet_ctl_sock_create+0x37/0x80
[   87.031520] 	(netns ffff9af471fa8000): open sk ffff9af475705580 family 10 state 7 dst_cache           (null) rx_dst           (null) creator inet_ctl_sock_create+0x37/0x80
[   87.031523] 	(netns ffff9af471fa8000): open sk ffff9af475703a80 family 10 state 7 dst_cache           (null) rx_dst           (null) creator inet_ctl_sock_create+0x37/0x80
[   87.031526] 	(netns ffff9af471fa8000): open sk ffff9af475702400 family 10 state 7 dst_cache           (null) rx_dst           (null) creator inet_ctl_sock_create+0x37/0x80
[   87.031529] 	(netns ffff9af471fa8000): open sk ffff9af475701f80 family 10 state 7 dst_cache           (null) rx_dst           (null) creator inet_ctl_sock_create+0x37/0x80
[   87.031532] 	(netns ffff9af471fa8000): open sk ffff9af475702880 family 10 state 7 dst_cache           (null) rx_dst           (null) creator inet_ctl_sock_create+0x37/0x80
[   87.031535] 	(netns ffff9af471fa8000): open sk ffff9af471fc0800 family 16 state 7 dst_cache           (null) rx_dst           (null) creator __netlink_kernel_create+0x6c/0x260
[   87.031567] 	(netns ffff9af471fa8000): open sk ffff9af473ffa100 family 2 state 4 dst_cache           (null) rx_dst ffff9af471ec4a00 creator generic_ip_connect+0x24b/0x4f0 [cifs]


That will include all open kernel sockets for the netns that's exiting, with dbg for the sockets.  Assuming the problem is caused by a kernel socket remaining open (with dst(s) holding reference(s) to the lo interface), we should be able to tell where the socket was created and what type of socket it is.

Of course, if the problem is a simple dst leak, this won't help show where it came from, but the debug output should still help in that case, to at least show the issue isn't being caused by a kernel socket.