DF-2668 re-run on the PATCHED kernel (#1, both fixes), as root:

  # mount -t null /tmp /tmp/nmtest
  /tmp on /tmp/nmtest (null, local)
  # /tmp/df2668 /tmp/nmtest/anchor_file
  DF-2668: getfh(/tmp/nmtest/anchor_file) ok; fh_fsid = 89630026,0000000b
  DF-2668: fhstatfs returned ok f_type=0
  DF-2668: survived fhstatfs (no KKASSERT?)
  EXIT=0
  # umount /tmp/nmtest && echo NULLFS-UNMOUNTED-OK
  NULLFS-UNMOUNTED-OK

No panic; mount_drop bookkeeping correct (the held vfs_getvfs mount is the
one dropped); the nullfs unmounts cleanly afterwards (no leaked hold).
Baseline kernel panicked inside the same syscall (see panic.txt / run.log).