DF-2670 — sys_fchown() charges VFS_ACCOUNT() against the cwd's mount, not the file's mount

Impact (quota accounting corruption; non-default config)

fchown(2) performs its ownership-transfer accounting (VFS_ACCOUNT(mp, o_uid, o_gid, -size) / VFS_ACCOUNT(mp, uid, gid, +size), sys/kern/vfs_syscalls.c:3560-3561) against p->p_fd->fd_ncdir.mount — the mount of the caller's current working directory — instead of the mount of the file being chowned (fp->f_nchandle.mount / vp->v_mount). When cwd and target file live on different mounts (trivial to arrange: cd /tmp (tmpfs), fchown(fd_of_file_on_/usr)):

• the file's real mount never gets its accounting adjusted → the new owner's usage on that mount is under-counted → quota bypass;
• the cwd's mount gets phantom ±size adjustments for uids that may not even own bytes there → accounting corruption / spurious EDQUOT for unrelated users;
• repeated chowns can drive a mount's accounting to arbitrary values.

Only manifests when VFS quota accounting is wired (non-default vfs.quota_enabled + quota-enabled mount), which is why the stock guest shows nothing — VFS_ACCOUNT is a no-op there. Certain by inspection.

Root cause (line-accurate)

sys/kern/vfs_syscalls.c:3637:

    if (error == 0)
        error = setfown(p->p_fd->fd_ncdir.mount,      /* <-- WRONG mount */
            (struct vnode *)fp->f_data, uap->uid, uap->gid);

Compare the correct siblings: * kern_chown() :3578: setfown(nd->nl_nch.mount, vp, uid, gid) (the file's mount); * kern_ftruncate() :4123: mp = vq_vptomp(vp) (mount of the file's vnode).

Not verified on the guest

Same reason as DF-2669: stock mounts don't wire vfs_account, so the mis-accounting is invisible without a quota-enabled setup; code-level conclusion is unambiguous (three sibling call sites, two correct, one not).

Recommended fix

--- a/sys/kern/vfs_syscalls.c
+++ b/sys/kern/vfs_syscalls.c
@@ sys_fchown()
    if (error == 0)
-       error = setfown(p->p_fd->fd_ncdir.mount,
+       error = setfown((fp->f_nchandle.mount) ? fp->f_nchandle.mount :
+               ((struct vnode *)fp->f_data)->v_mount,
            (struct vnode *)fp->f_data, uap->uid, uap->gid);

(mirrors the mp selection already used by kern_fstatfs() at :1495-1496).