DF-3171 fix validation (defense-in-depth guard for an unmanifested hazard).

Kernel: patched in-guest builds #1 (16:11:08 source / booted 16:11-era
"Mon Sep  7 16:11:15 UTC 2026") and #2 ("Mon Sep  7 16:51:08 UTC 2026");
both carry DF-3170's spinlock fix + this finding's si_mountpoint guard.
Build/install receipts identical in shape to the DF-3170 pack's
fix_build.log (make -j6 nativekernel + make installkernel; mfs_vfsops.o
compiled clean under -Werror).

Validation matrix on the patched kernel:
  [1] holder (sleep-90 read-only fd) + `umount -f` of second devfs:
      server SURVIVED, mount stayed healthy, dd I/O verified working
      (this construction also does not fire on stock — the guard is
      simply never exercised by it; proven no-harm).
  [2] NORMAL lifecycle (the path the guard must not break):
      mount_mfs -> dd write OK -> umount rc=0 -> mount gone,
      server exited (EMOUNTEXIT), /dev/mfsN removed. INTACT.
  [3] 11+ min multi-mount stress (DF-3170 rig): no regression.

fix_status=inconclusive — the guarded behavior could not be shown
bad-then-good because no trigger manifested the bug on the stock kernel;
the guard is proven safe and lifecycle-preserving.