--- a/sys/kern/vfs_nlookup.c	2026-06-29 12:51:19.000000000 +0000
+++ b/sys/kern/vfs_nlookup.c	2026-10-26 05:32:30.895442793 +0000
@@ -757,6 +757,23 @@
 		} else {
 			nctmp.ncp = nctmp.ncp->nc_parent;
 		}
+		/*
+		 * The current directory's namecache topology can become
+		 * disconnected (its directory was removed out from under us
+		 * while fd_ncdir still holds a reference, so the deferred
+		 * zap completed and left nc_parent NULL, unhashed and
+		 * unnamed while the ncp stays alive).  Recover using the
+		 * process root -- the same recovery the jail-break case
+		 * above uses -- instead of dereferencing NULL below.
+		 */
+		if (nctmp.ncp == NULL) {
+			kprintf("vfs_nlookup: '..' traverse disconnected: "
+				"pid %d (%s)\n",
+				curthread->td_proc ?
+				curthread->td_proc->p_pid : 0,
+				curthread->td_comm);
+			nctmp = nd->nl_rootnch;
+		}
 		if (last_element) {
 		    cache_get_maybe_shared(&nctmp, &nch,
 					   wantsexcllock(nd, 1));