SMBFS = instant panic in CURRENT of April 4

A 6.0-CURRENT installation updated yesterday cannot access SMB shares.
It instantly panics when I try ls(1) on an SMB mounted disk.  The cause
of the panic seems to be a call of VOP_GETATTR_APV() with a NULL vop
pointer, which is dereferenced at line 100 of vnode_if.c

orion:/var/crash# kgdb /usr/obj/usr/src/sys/ORION/kernel.debug vmcore.0
[GDB will not be able to debug user-mode threads:
 /usr/lib/libthread_db.so: Undefined symbol "ps_pglobal_lookup"]
GNU gdb 6.1.1 [FreeBSD]
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i386-marcel-freebsd".
#0  doadump () at pcpu.h:164
164     pcpu.h: No such file or directory.
        in pcpu.h
(kgdb) bt
#0  doadump () at pcpu.h:164
#1  0xc046924a in db_fncall (dummy1=0, dummy2=0, dummy3=-1066866757,
    dummy4=0xd478f7d0 "όχxΤόχxΤLΛhΐ (~ΐ \t")
    at /usr/src/sys/ddb/db_command.c:531
#2  0xc0469058 in db_command (last_cmdp=0xc0773004, cmd_table=0x0,
    aux_cmd_tablep=0xc0704fd4, aux_cmd_tablep_end=0xc0704fd8)
    at /usr/src/sys/ddb/db_command.c:349
#3  0xc0469120 in db_command_loop () at /usr/src/sys/ddb/db_command.c:455
#4  0xc046aca5 in db_trap (type=12, code=0) at /usr/src/sys/ddb/db_main.c:221
#5  0xc055b2c3 in kdb_trap (type=12, code=0, tf=0xd478f968)
    at /usr/src/sys/kern/subr_kdb.c:421
#6  0xc06a466d in trap_fatal (frame=0xd478f968, eva=499)
    at /usr/src/sys/i386/i386/trap.c:801
#7  0xc06a43f3 in trap_pfault (frame=0xd478f968, usermode=0, eva=499)
    at /usr/src/sys/i386/i386/trap.c:724
#8  0xc06a4039 in trap (frame=
      {tf_fs = -730333160, tf_es = -730333168, tf_ds = -730333168, tf_edi = -1039626748, tf_esi = -730268616, tf_ebp = -730269268, tf_isp = -730269292, tf_ebx = -730269072, tf_edx = -730269072, tf_ecx = -1043018368, tf_eax = 455, tf_trapno = 12, tf_err = 0, tf_eip = -1066699392, tf_cs = 8, tf_eflags = 66050, tf_esp = -1039656384, tf_ss = -730268980}) at /usr/src/sys/i386/i386/trap.c:414
#9  0xc069720a in calltrap () at /usr/src/sys/i386/i386/exception.s:139
#10 0xd4780018 in ?? ()
#11 0xd4780010 in ?? ()
#12 0xd4780010 in ?? ()
#13 0xc2088e04 in ?? ()
#14 0xd478fc38 in ?? ()
#15 0xd478f9ac in ?? ()
#16 0xd478f994 in ?? ()
#17 0xd478fa70 in ?? ()
#18 0xd478fa70 in ?? ()
#19 0xc1d4cd80 in ?? ()
#20 0x000001c7 in ?? ()
#21 0x0000000c in ?? ()
#22 0x00000000 in ?? ()
#23 0xc06b7580 in VOP_GETATTR_APV (vop=0x0, a=0xd478fa70) at vnode_if.c:530
#24 0xc20791aa in ?? ()
#25 0x000001c7 in ?? ()
#26 0xd478fa70 in ?? ()
#27 0xc05666c4 in witness_lock_list_free (lle=0xc2081a40)
    at /usr/src/sys/kern/subr_witness.c:1695
#28 0xc06b70aa in VOP_LOOKUP_APV (vop=0x0, a=0xd478fc38) at vnode_if.c:100
#29 0xc0590cda in lookup (ndp=0xd478fc10) at vnode_if.h:56
#30 0xc0590672 in namei (ndp=0xd478fc10) at /usr/src/sys/kern/vfs_lookup.c:202
#31 0xc059bd11 in kern_stat (td=0xc1ce62e0, path=0x0, pathseg=UIO_USERSPACE,
    sbp=0xd478fc84) at /usr/src/sys/kern/vfs_syscalls.c:2057
#32 0xc059bcbf in stat (td=0xc1ce62e0, uap=0xd478fd14)
    at /usr/src/sys/kern/vfs_syscalls.c:2042
#33 0xc06a4913 in syscall (frame=
      {tf_fs = 47, tf_es = 47, tf_ds = 47, tf_edi = -1077943408, tf_esi = 134557824, tf_ebp = -1077943288, tf_isp = -730268300, tf_ebx = 672681028, tf_edx = 134557824, tf_ecx = 0, tf_eax = 188, tf_trapno = 12, tf_err = 2, tf_eip = 672158875, tf_cs = 31, tf_eflags = 662, tf_esp = -1077943444, tf_ss = 47})
    at /usr/src/sys/i386/i386/trap.c:951
#34 0xc069725f in Xint0x80_syscall () at /usr/src/sys/i386/i386/exception.s:200
#35 0x0000002f in ?? ()
#36 0x0000002f in ?? ()
#37 0x0000002f in ?? ()
#38 0xbfbfe390 in ?? ()
#39 0x08053080 in ?? ()
#40 0xbfbfe408 in ?? ()
#41 0xd478fd74 in ?? ()
#42 0x28184c44 in ?? ()
#43 0x08053080 in ?? ()
#44 0x00000000 in ?? ()
#45 0x000000bc in ?? ()
#46 0x0000000c in ?? ()
#47 0x00000002 in ?? ()
#48 0x2810549b in ?? ()
#49 0x0000001f in ?? ()
#50 0x00000296 in ?? ()
#51 0xbfbfe36c in ?? ()
#52 0x0000002f in ?? ()
#53 0x5f485353 in ?? ()
#54 0x48545541 in ?? ()
#55 0x434f535f in ?? ()
#56 0x0000004b in ?? ()
#57 0x1376e000 in ?? ()
#58 0xc1ce5de4 in ?? ()
#59 0xc1ce62e0 in ?? ()
#60 0xd478f698 in ?? ()
#61 0xd478f680 in ?? ()
#62 0xc184c170 in ?? ()
#63 0xc0553cf3 in sched_switch (td=0x8053080, newtd=0x28184c44, flags=Cannot access memory at address 0xbfbfe418
)
    at /usr/src/sys/kern/sched_4bsd.c:963
Previous frame inner to this frame (corrupt stack?)
(kgdb) up 28
#28 0xc06b70aa in VOP_LOOKUP_APV (vop=0x0, a=0xd478fc38) at vnode_if.c:100
100                     rc = vop->vop_lookup(a);
(kgdb)