Yep, this is a bug in nullfs.  Basically, the stock nullfs passes locks
along to its underlying filesystem.  This won't DTRT in many cases, such
as the one you discovered.

I have some nullfs changes to implement its own locking layer, but I
can't get to the changes until I return from a just-started week-long
trip.  Ping me after the 24th if you'd like my changes.

==John