> Why is this in the "make snapshot" script if it requires single-user 
> mode execution? 

Because it's required to build the snapshot, since install/boot
filesystem images are part of the snapshot.

> Is there some way we can make it permissible for vnd 
> in multiuser mode without compromising security?

yes, but it's a lot of work; you need to write a read-write
"standalone" filesystem library.

one of my long-term goals is to change the build to completely avoid
the need to use vnd and native filesystems for filesystem image
construction during the build.

				- Bill