=== UNPATCHED smbfs.ko smbfs_readvnode VDIR branch — relocation call sequence ===
(The dead-code lock upgrade is compiled away: NO vn_islocked, NO vn_lock before
 smbfs_readvdir runs. The VDIR path executes the directory iteration under the
 shared lock that vn_read took at vfs_vnops.c:751.)

call targets in smbfs_readvnode (unpatched):
  c62e: smb_makescred        <- VDIR branch entry, straight into readvdir setup
  c6ac: smbfs_findclose
  c6e9: smbfs_findopen
  c735: smbfs_findnext
  c76a: smbfs_findclose
  vn_islocked count: 0      vn_lock count: 0     <- DEAD UPGRADE CONFIRMED

=== PATCHED smbfs.ko smbfs_readvnode VDIR branch — relocation call sequence ===
(The fix restores lock-state detection via vn_islocked() and emits the
 conditional vn_lock(LK_UPGRADE) / vn_lock(LK_DOWNGRADE) around smbfs_readvdir.)

call targets in smbfs_readvnode (patched):
  be18: vn_islocked          <- NEW: detect shared vs exclusive
  be60: smb_makescred
  beea: smbfs_findclose
  bf35: smbfs_findopen
  bf94: smbfs_findnext
  bfca: smbfs_findclose
  c006: vn_lock              <- NEW: LK_UPGRADE (shared -> exclusive)
  c018: vn_lock              <- NEW: LK_DOWNGRADE (exclusive -> shared)
  vn_islocked count: 1       vn_lock count: 2     <- UPGRADE RESTORED