I readily admit that I did something bogus, but I think I really did
it accidentally earlier while not knowing what I was doing with puffs,
and managed to stumble on it again while trying many things that
worked fine.

# gdb pnullfs
(gdb) run -s -o ro / /mnt
Starting program: /usr/home/gdt/examples/pnullfs/pnullfs -s -o ro / /mnt

That's sick, I know, but I think I didn't get what nullfs did or what
it's arguments were and typed something, umm, minimal.

This resulted in a wedged server

0 1709 1231    0  -2  0  1388   812 vnlock   DX+  ttyp1 0:00.03 /usr/home/gdt/examples/pnullfs/pnullfs -s -o ro / /mnt

and some wedged ls processes

10853  683  796    0  28  0    48   620 -        T    ttyp2 0:00.01 ls -l /mnt 
10853 1748  796  396  -2  0    48   620 vnlock   D    ttyp2 0:00.01 ls -l /mnt 
10853 2743  796    0  28  0    56   672 puffs1   D    ttyp2 0:00.01 ls -l 

and I have a ls -l in that dir in puffs1, and another in vnlock.

Here's a trace of pnullfs (via ddb: tr/tl 0t1709) and the ls -l in
puffs1.

trace: pid 1709  at 0xcb63a8fc
ltsleep(cb7ee9a4,14,c071d34e,0,cb7ee9a4) at netbsd:ltsleep+0x244
acquire(0,600,c02cb157,0,1) at netbsd:acquire+0x148
lockmgr(cb7ee9a4,10002,cb7ee934,30002,cb7ee934) at netbsd:lockmgr+0x31b
puffs_lock(cb63a9d0,8000,cb63ab18,c06561c0,cb7ee934) at netbsd:puffs_lock+0x47
VOP_LOCK(cb7ee934,10002,ca791dc8,ca794ed8,0) at netbsd:VOP_LOCK+0x25
vn_lock(cb7ee934,30002,0,cb604934,c0ddd000) at netbsd:vn_lock+0x87
vget(cb7ee934,30002,cb63aa6c,c0411dd8,cb63aa60) at netbsd:vget+0xa1
puffs_root(c0efb000,cb63aac8,0,c0411da5,cb63aaa0) at netbsd:puffs_root+0x39
lookup(cb63abd8,20002,400,cb63abf0,cb63ab38) at netbsd:lookup+0x298
namei(cb63abd8,c078b5e8,cb63ab8c,c0411dd8,cb63ab80) at netbsd:namei+0xf9
sys___lstat30(cb38c254,cb63ac48,cb63ac68,18041969,1) at netbsd:sys___lstat30+0x46
syscall_plain() at netbsd:syscall_plain+0x149
--- syscall (number 389) ---
0xbbba12ef:

trace: pid 2743  at 0xcb6454cc
ltsleep(cb645560,32,c0718b6c,0,0) at netbsd:ltsleep+0x244
touser(1b,0,cb7ee934,0,0) at netbsd:touser+0x158
puffs_vntouser(c0f00c00,0,cb6455bc,490,804c000) at netbsd:puffs_vntouser+0x53
puffs_lookup(cb645a6c,cb645aa0,c0655a80,cb7ee934,cb645be8) at netbsd:puffs_lookup+0x10f
VOP_LOOKUP(cb7ee934,cb645be8,cb645bfc,c0411da5,cb645aa0) at netbsd:VOP_LOOKUP+0x2b
lookup(cb645bd8,20002,400,cb645bf0,0) at netbsd:lookup+0x1ec
namei(cb645bd8,8050c54,64,c0656200,cb02) at netbsd:namei+0xf9
sys___lstat30(cb38c12c,cb645c48,cb645c68,cb640010,10) at netbsd:sys___lstat30+0x46
syscall_plain() at netbsd:syscall_plain+0x149
--- syscall (number 389) ---
0xbbba82ef:

(Copying tech-kern because this seems like it might be hard to fix.)