NFSSVC_MNTD path type-confuses any filesystem's mount into struct nfsmount: VROOT check without vfstype check before VFSTONFS(vp->v_mount)

Summary

The NFSSVC_MNTD branch resolves ncd.ncd_dirp and only checks (vp->v_flag & VROOT) before casting nmp = VFSTONFS(vp->v_mount) - i.e. mp->mnt_data of ANY filesystem (the root of a UFS/HAMMER2 mount passes VROOT). The bogus struct nfsmount* is handed to nfs_clientd() (nfs_kerb.c:70), which reads nm_state, publishes ncd data from nm_* fields to the caller (kernel-memory disclosure of foreign mount structures), and on NFSSVC_GOTAUTH copyin()s attacker-length data into nmp->nm_authstr/nmp->nm_verfstr - pointers read out of foreign mount data -> wild kernel writes; it also tsleeps on garbage and can dounmount() the confused mount. Requires root (nfssvc privilege gate), so intra-kernel type confusion available to an already-privileged user (relevant to jailed/separated daemon contexts granted SYSCAP_RESTRICTEDROOT). Skipped guest verification (Low, privileged-only). Fix: validate mnt_vfc == &nfs_vfsconf before the cast.