Namecache reference leaked on every successful call (cache_drop never called)

Summary

Success path: nch copied from nd, nd zeroed(:86-87). cache_unlock(&nch)(:102) releases lock only. cache_drop never called (vfs_cache.c:1233 unlocks only, :1090 drops ref). Comment :130 confirms: leave ref intact. Slow unbounded leak of ncp+mount refs per call. Caller vn_opendisk receives only vnode not nch.