Fix for DF-2782: guard the shared exit path against mq == NULL (the :577 EMFILE goto releases a lock that was never acquired on a NULL-derived address).

--- sys/kern/sys_mqueue.c
+++ sys/kern/sys_mqueue.c
@@ -593,7 +593,8 @@
 	mq->mq_refcnt++;
 	fp->f_data = mq;
 exit:
-	lockmgr(&mq->mq_mtx, LK_RELEASE);
+	if (mq)
+		lockmgr(&mq->mq_mtx, LK_RELEASE);
 	lockmgr(&mqlist_mtx, LK_RELEASE);
 
 	if (mq_new)