o Note an additional potential problem here: LOCKD_MSG directly exports

struct ucred to userland.  In 5.0-CURRENT, it is desirable to instead
  export struct xucred, as ucred contains mutexes, pointers, and other
  kernel evil.  I'll add it to my work queue.

sys/nfsclient/nfs_lock.c

@@ -132,6 +132,10 @@ nfs_dolock(struct vop_advlock_args *ap)
 	msg.lm_getlk = ap->a_op == F_GETLK;
 	/*
 	 * XXX  -- I think this is wrong for anything other AF_INET.
+	 *
+	 * XXX: the lm_cred assignment below directly exports a ucred
+	 * structure to userland.  This is probably wrong, and should at
+	 * least be xucred.
 	 */
 	msg.lm_addr = *(VFSTONFS(vp->v_mount)->nm_nam);
 	msg.lm_fh_len = NFS_ISV3(vp) ? VTONFS(vp)->n_fhsize : NFSX_V2FH;