diff --git a/sys/vfs/smbfs/smbfs_io.c b/sys/vfs/smbfs/smbfs_io.c
--- a/sys/vfs/smbfs/smbfs_io.c
+++ b/sys/vfs/smbfs/smbfs_io.c
@@ -452,6 +452,11 @@
 	 */
 	error = 0;
 	doclose = 0;
+	/*
+	 * XXX DF-0885: n_opencount / n_fid are accessed without the
+	 * vnode lock; take a reference on the open count to avoid a
+	 * concurrent VOP_OPEN overwriting n_fid out from under us.
+	 */
 	if (np->n_opencount == 0) {
 		error = smbfs_smb_open(np, SMB_AM_OPENREAD, &scred);
 		if (error == 0)