dm_fdlist is walked and mutated without any common lock — nresolve's TAILQ scan races dirfs_node_setpassive's INSERT/REMOVE on SMP vkernels (UAF / list corruption)

Summary

dirfs_nresolve scans dm_fdlist under only the PARENT NODE's lock (:171-181), while dirfs_node_setpassive INSERTs/REMOVEs entries (dirfs_subr.c:812/:827) from contexts holding different or no dirfs locks: dirfs_inactive (:1391, no lock), dirfs_nremove (:913, holds the file's parent-dir lock - a different node when dirs differ), dirfs_nrename (:999, no lock), and reclaim via dirfs_node_free. A concurrent TAILQ mutation during the FOREACH_MUTABLE walk (or setname's kfree of dn_name during another thread's strcmp at :174) yields use-after-free reads / corrupted traversal in the vkernel heap. Speculative: requires multi-CPU vkernel and tight timing; single-CPU vkernels immune (cooperative serialization). Fix: mount token or dm_lock around the nresolve walk and every setpassive/insert/remove path + node lock/ref before strcmp.