# DF-2670 — `sys_fchown()` charges `VFS_ACCOUNT()` against the **cwd's** mount, not the file's mount

## Impact (quota accounting corruption; non-default config)
`fchown(2)` performs its ownership-transfer accounting
(`VFS_ACCOUNT(mp, o_uid, o_gid, -size)` / `VFS_ACCOUNT(mp, uid, gid, +size)`,
`sys/kern/vfs_syscalls.c:3560-3561`) against `p->p_fd->fd_ncdir.mount` —
the mount of the caller's **current working directory** — instead of the
mount of the file being chowned (`fp->f_nchandle.mount` /
`vp->v_mount`). When cwd and target file live on different mounts (trivial
to arrange: `cd /tmp` (tmpfs), `fchown(fd_of_file_on_/usr)`):

* the file's real mount never gets its accounting adjusted → the new
  owner's usage on that mount is under-counted → **quota bypass**;
* the cwd's mount gets phantom ±size adjustments for uids that may not
  even own bytes there → accounting corruption / spurious `EDQUOT` for
  unrelated users;
* repeated chowns can drive a mount's accounting to arbitrary values.

Only manifests when VFS quota accounting is wired (non-default
`vfs.quota_enabled` + quota-enabled mount), which is why the stock guest
shows nothing — `VFS_ACCOUNT` is a no-op there. Certain by inspection.

## Root cause (line-accurate)
`sys/kern/vfs_syscalls.c:3637`:
```c
	if (error == 0)
		error = setfown(p->p_fd->fd_ncdir.mount,      /* <-- WRONG mount */
			(struct vnode *)fp->f_data, uap->uid, uap->gid);
```
Compare the correct siblings:
* `kern_chown()` `:3578`: `setfown(nd->nl_nch.mount, vp, uid, gid)`
  (the file's mount);
* `kern_ftruncate()` `:4123`: `mp = vq_vptomp(vp)` (mount of the file's
  vnode).

## Not verified on the guest
Same reason as DF-2669: stock mounts don't wire `vfs_account`, so the
mis-accounting is invisible without a quota-enabled setup; code-level
conclusion is unambiguous (three sibling call sites, two correct, one not).

## Recommended fix
```diff
--- a/sys/kern/vfs_syscalls.c
+++ b/sys/kern/vfs_syscalls.c
@@ sys_fchown()
 	if (error == 0)
-		error = setfown(p->p_fd->fd_ncdir.mount,
+		error = setfown((fp->f_nchandle.mount) ? fp->f_nchandle.mount :
+				((struct vnode *)fp->f_data)->v_mount,
 			(struct vnode *)fp->f_data, uap->uid, uap->gid);
```
(mirrors the mp selection already used by `kern_fstatfs()` at `:1495-1496`).