7268d74c7c
in savedvp variable and it is used for the argument of MOUNTTOUNIONMOUNT(). I didn't realize ap->a_vp is modified before MOUNTTOUNIONMOUNT(), so the change by revision 1.22 is incorrect.