vnode deadlock with nullfs?

I turned on debug.mpsafevm on a SMP package build machine, and it
didn't last long before grinding to a halt:

db> trace 10328
sched_switch(c5b32c60,0,15d,c072db39,c5b32c60) at sched_switch+0xec
mi_switch(1,0,c072fd06,198,c053c3c3) at mi_switch+0x2e4
sleepq_switch(c5abbd0c,1,c5b32c60,c5abbd0c,f121e928) at sleepq_switch+0x135
sleepq_wait(c5abbd0c,0,c072da37,e7,0) at sleepq_wait+0x11
msleep(c5abbd0c,c07a0814,50,c0733c07,0) at msleep+0x4a7
acquire(f121e9b0,1000040,200,e7,c5abbd0c) at acquire+0xf7
lockmgr(c5abbd0c,1010002,c5abbc60,c5b32c60) at lockmgr+0x45e
ufs_lock(f121ea00,f121ea1c,c05b5233,f121ea00,c067e47a) at ufs_lock+0x4a
ufs_vnoperate(f121ea00,c067e47a,c5b1a2bc,1010002,c5b1a210) at ufs_vnoperate+0x18
vn_lock(c5abbc60,10002,c5b32c60,0,2) at vn_lock+0x11a
vget(c5abbc60,10002,c5b32c60,7d,c5b32c60) at vget+0x102
ufs_ihashget(c59f0e00,2,2,f121eb00,1000000) at ufs_ihashget+0xd8
ffs_vget(c585f800,2,2,f121eb00,0) at ffs_vget+0x44
ufs_root(c585f800,f121eb54,c5b32c60,c071eb1f,c5b1a210) at ufs_root+0x29
lookup(f121ec10,0,c07353b7,a4,1) at lookup+0x60c
namei(f121ec10,0,d8,f121ec44,c053c100) at namei+0x2a1
stat(c5b32c60,f121ed14,c0748ea3,3e2,c5b32c60) at stat+0x52
syscall(2f,2f,2f,8083e12,8083e12) at syscall+0x2c8
Xint0x80_syscall() at Xint0x80_syscall+0x1f
--- syscall (188, FreeBSD ELF32, stat), eip = 0x8067157, esp = 0xbfbfdfbc, ebp = 0xbfbfecc0 ---
db> show lockedvnods
Locked vnodes
0xc5abbc60: tag ufs, type VDIR, usecount 16, writecount 0, refcount 1, flags (VV_ROOT|VV_OBJBUF), lock type ufs: EXCL (count 1) by thread 0xc5a7c420 (pid 10304) with 15 pending
        ino 2, on dev da0s1e (4, 17)
0xc5d3a318: tag ufs, type VDIR, usecount 2, writecount 0, refcount 2, flags (VV_OBJBUF), lock type ufs: EXCL (count 1) by thread 0xc5a1dc60 (pid 10310) with 1 pending
        ino 376832, on dev da0s1e (4, 17)
0xc5d4a420: tag ufs, type VDIR, usecount 3, writecount 0, refcount 2, flags (VV_OBJBUF), lock type ufs: EXCL (count 1) by thread 0xc578d840 (pid 10309) with 1 pending
        ino 376833, on dev da0s1e (4, 17)
0xc5f24738: tag ufs, type VDIR, usecount 4, writecount 0, refcount 2, flags (VV_OBJBUF), lock type ufs: EXCL (count 1) by thread 0xc5a7b9a0 (pid 10301) with 1 pending
        ino 377018, on dev da0s1e (4, 17)
0xc5fb5840: tag ufs, type VDIR, usecount 6, writecount 0, refcount 2, flags (VV_OBJBUF), lock type ufs: EXCL (count 1) by thread 0xc5d4eb00 (pid 9831) with 1 pending
        ino 400386, on dev da0s1e (4, 17)
0xc6263000: tag ufs, type VDIR, usecount 5, writecount 0, refcount 2, flags (VV_OBJBUF), lock type ufs: EXCL (count 1) by thread 0xc578db00 (pid 9801) with 2 pending
        ino 424617, on dev da0s1e (4, 17)
0xc9465a50: tag ufs, type VREG, usecount 3, writecount 0, refcount 0, lock type ufs: EXCL (count 1) by thread 0xc5b319a0 (pid 9802) with 1 pending
        ino 425034, on dev da0s1e (4, 17)
0xc8fcb738: tag null, type VDIR, usecount 1, writecount 0, refcount 0, flags (VV_ROOT|VV_OBJBUF), lock type ufs: EXCL (count 1) by thread 0xc5d4eb00 (pid 9831) with 1 pending
        vp=0xc8fcb738, lowervp=0xc5fb5840
0xc8bee318: tag null, type VDIR, usecount 0, writecount 0, refcount 0, lock type ufs: EXCL (count 1) by thread 0xc578db00 (pid 9801) with 2 pending
        vp=0xc8bee318, lowervp=0xc6263000
0xc8b09318: tag null, type VREG, usecount 1, writecount 0, refcount 0, lock type ufs: EXCL (count 1) by thread 0xc5b319a0 (pid 9802) with 1 pending
        vp=0xc8b09318, lowervp=0xc9465a50
0xc90ebc60: tag null, type VDIR, usecount 1, writecount 0, refcount 0, flags (VV_ROOT|VV_OBJBUF), lock type ufs: EXCL (count 1) by thread 0xc5d4eb00 (pid 9831) with 1 pending
        vp=0xc90ebc60, lowervp=0xc5fb5840
0xc8925e70: tag null, type VDIR, usecount 1, writecount 0, refcount 0, lock type ufs: EXCL (count 1) by thread 0xc578db00 (pid 9801) with 2 pending
        vp=0xc8925e70, lowervp=0xc6263000
db>

I'm going to try and repeat this with DEBUG_VFS_LOCKS and WITNESS.

Kris