panic: XXX

Another NFS traversal/umount -f race

panic: XXX
cpuid = 0
KDB: enter: panic
[thread pid 29303 tid 100139 ]
Stopped at      kdb_enter+0x30: leave
db> wh
Tracing pid 29303 tid 100139 td 0xca205000
kdb_enter(c071c7f5,0,c07259e2,f7bbd8f8,ca205000) at kdb_enter+0x30
panic(c07259e2,f7bbd93c,ca205000,c0836a2c,0) at panic+0x13f
lookup(f7bbdb68,0,c0725967,b6,c075cc78) at lookup+0x650
namei(f7bbdb68,c071e25e,26e,ca205000,ca205000) at namei+0x42b
vn_open_cred(f7bbdb68,f7bbdc68,0,c985cd80,3) at vn_open_cred+0x2bf
vn_open(f7bbdb68,f7bbdc68,0,3,f7bbdaf4) at vn_open+0x33
kern_open(ca205000,804dd86,0,1,0) at kern_open+0xca
open(ca205000,f7bbdd04,c,ca205000,ca1d7a50) at open+0x36
syscall(2808003b,3b,bfbf003b,3,bfbfe898) at syscall+0x2e9
Xint0x80_syscall() at Xint0x80_syscall+0x1f
--- syscall (5, FreeBSD ELF32, open), eip = 0x2813733f, esp = 0xbfbfe82c, ebp = 0xbfbfe868 ---
db>

The panic comes from here:

       /*
         * Check to see if the vnode has been mounted on;
         * if so find the root of the mounted filesystem.
         */
        while (dp->v_type == VDIR && (mp = dp->v_mountedhere) &&
               (cnp->cn_flags & NOCROSSMOUNT) == 0) {
                KASSERT(dp != ndp->ni_dvp, ("XXX"));