f18676ff22
Our vput calls vm_object_deallocate() --> vm_object_terminate(). The vm_object_terminate() calls vn_lock(), since UN_LOCKED has been already cleared in union_unlock(). Then, union_lock locks upper vnode when UN_ULOCK is not set. The upper vnode is not unlocked when UN_KLOCK is set in union_unlock(), thus, union_lock tries to lock locked vnode and we get panic.