I think I am close to finding the cause of bug 5026 (vrele ref cnt panic).
I'm hoping someone who is familiar with the code can help.  The problem
seems to only occur (at least on my system) in the nfsrv_rename routine.
What seems to be happening is that the fromnd structure looks like this:

$9 = {ni_dirp = 0xf07f1400 "", ni_segflg = UIO_SYSSPACE, 
  ni_startdir = 0xf07c9d80, ni_rootdir = 0xf0793c00, ni_vp = 0xf07dc180, 
  ni_dvp = 0xf07c9d80, ni_pathlen = 1, ni_next = 0xf07f4690 "", 
  ni_loopcnt = 4078325152, ni_cnd = {cn_nameiop = 2, cn_flags = 38156, 
    cn_proc = 0xf0793c00, cn_cred = 0xf07e2684, 
    cn_pnbuf = 0xf07f4680 "4Dwmdeskname.tmp", 
    cn_nameptr = 0xf07f4680 "4Dwmdeskname.tmp", cn_namelen = 16, 
    cn_hash = 1571, cn_consume = 0}}


Note that ni_startdir == ni_dvp.  I believe what is going on is that
the following code is being executed (lines 1838 - 1841 of nfs_serv.c):

                VOP_ABORTOP(fromnd.ni_dvp, &fromnd.ni_cnd);
                vrele(fromnd.ni_dvp);
                vrele(fvp);
                goto out1;  

Then at the out1 label: (line 1922)

        if (fdirp) {
                fdiraft_ret = VOP_GETATTR(fdirp, &fdiraft, cred, procp);
                vrele(fdirp);
        }
        if (tdirp) {
                tdiraft_ret = VOP_GETATTR(tdirp, &tdiraft, cred, procp);
                vrele(tdirp);   
        }
        vrele(fromnd.ni_startdir);

So the vnode that is pointed to by both fromnd.ni_dvp and fromnd.ni_startdir
is vrele'ed twice.  Unfortunately I don't really have a good understanding
of how this code works, so I could be completely off base.  I'm hoping that
someone who is familiar with this code can shed some light on what is
going on here.  For those that are interested the following files are
available via my http server:

http://www.cs.unlv.edu/~greg/netbsd.gdb.gz
http://www.cs.unlv.edu/~greg/netbsd.5.core.gz
http://www.cs.unlv.edu/~greg/netbsd.6.core.gz


					--Greg