Caution with use after exi_rele()
Be far more judicious in the use of curzone-using macros.

*** 409,418 ****
--- 409,419 ----
          /*
           * Allow lookups from the root - the default
           * location of the public filehandle.
           */
          if (exi != NULL && (exi->exi_export.ex_flags & EX_PUBLIC)) {
+                 ASSERT3U(exi->exi_zoneid, ==, curzone->zone_id);
                  dvp = ZONE_ROOTVP();
                  VN_HOLD(dvp);
  
                  DTRACE_NFSV3_5(op__lookup__start, struct svc_req *, req,
                      cred_t *, cr, vnode_t *, dvp, struct exportinfo *, exi,
*** 477,486 ****
--- 478,488 ----
           */
          if (PUBLIC_FH3(&args->what.dir)) {
                  publicfh_flag = TRUE;
  
                  exi_rele(exi);
+                 exi = NULL;
  
                  error = rfs_publicfh_mclookup(name, dvp, cr, &vp,
                      &exi, &sec);
  
                  /*
*** 560,570 ****
          }
  
          va.va_mask = AT_ALL;
          vap = rfs4_delegated_getattr(vp, &va, 0, cr) ? NULL : &va;
  
-         exi_rele(exi);
          VN_RELE(vp);
  
          resp->status = NFS3_OK;
          vattr_to_post_op_attr(vap, &resp->resok.obj_attributes);
          vattr_to_post_op_attr(dvap, &resp->resok.dir_attributes);
--- 562,571 ----
*** 579,588 ****
--- 580,590 ----
  
          DTRACE_NFSV3_5(op__lookup__done, struct svc_req *, req,
              cred_t *, cr, vnode_t *, dvp, struct exportinfo *, exi,
              LOOKUP3res *, resp);
          VN_RELE(dvp);
+         exi_rele(exi);
  
          return;
  
  out:
          if (curthread->t_flag & T_WOULDBLOCK) {
*** 2672,2681 ****
--- 2674,2684 ----
          if (name == NULL) {
                  resp->status = NFS3ERR_INVAL;
                  goto err1;
          }
  
+         ASSERT3U(exi->exi_zoneid, ==, curzone->zone_id);
          error = VOP_RMDIR(vp, name, ZONE_ROOTVP(), cr, NULL, 0);
  
          if (name != args->object.name)
                  kmem_free(name, MAXPATHLEN + 1);