kern/60632: vfs_getvfs races with unmount

["campbell+netbsd%mumble.net@localhost via gnats" <gnats-admin%NetBSD.org@localhost>]

>Number:         60632
>Category:       kern
>Synopsis:       vfs_getvfs races with unmount
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sat Aug 22 18:00:01 +0000 2026
>Originator:     Taylor R Campbell
>Release:        current, 11, 10, 9, ...
>Organization:
The NetUAF Mountation, Inc.
>Environment:
>Description:

	By the time vfs_getvfs has returned a struct mount pointer, a
	concurrent unmount may have freed it.

>How-To-Repeat:

	code inspection

>Fix:

	1. Make vfs_getvfs do vfs_busy while the struct mount pointer
	   is still stable (between mountlist_iterator_next and
	   mountlist_iterator_destroy).

	2. Teach all the callers to do vfs_rele.