vl: use QLIST_FOREACH_SAFE to visit change state handlers