diff --git a/sys/kern/vfs_lookup.c b/sys/kern/vfs_lookup.c
index 4cd4b013d67a..b963a94f123d 100644
--- a/sys/kern/vfs_lookup.c
+++ b/sys/kern/vfs_lookup.c
@@ -404,6 +404,10 @@ lookup(ndp)
 			if ((dp->v_flag & VROOT) == 0 ||
 			    (cnp->cn_flags & NOCROSSMOUNT))
 				break;
+			if (dp->v_mount == NULL) {	/* forced unmount */
+				error = EBADF;
+				goto bad;
+			}
 			tdp = dp;
 			dp = dp->v_mount->mnt_vnodecovered;
 			vput(tdp);
@@ -426,7 +430,7 @@ lookup(ndp)
 		printf("not found\n");
 #endif
 		if ((error == ENOENT) &&
-		    (dp->v_flag & VROOT) &&
+		    (dp->v_flag & VROOT) && (dp->v_mount != NULL) &&
 		    (dp->v_mount->mnt_flag & MNT_UNION)) {
 			tdp = dp;
 			dp = dp->v_mount->mnt_vnodecovered;
@@ -510,6 +514,12 @@ lookup(ndp)
 	    ((cnp->cn_flags & FOLLOW) || trailing_slash ||
 	     *ndp->ni_next == '/')) {
 		cnp->cn_flags |= ISSYMLINK;
+		if (dp->v_mount == NULL) {
+			/* We can't know whether the directory was mounted with
+			 * NOSYMFOLLOW, so we can't follow safely. */
+			error = EBADF;
+			goto bad2;
+		}
 		if (dp->v_mount->mnt_flag & MNT_NOSYMFOLLOW) {
 			error = EACCES;
 			goto bad2;