Caution with use after exi_rele()
Be far more judicious in the use of curzone-using macros.

@@ -409,10 +409,11 @@
         /*
          * Allow lookups from the root - the default
          * location of the public filehandle.
          */
         if (exi != NULL && (exi->exi_export.ex_flags & EX_PUBLIC)) {
+                ASSERT3U(exi->exi_zoneid, ==, curzone->zone_id);
                 dvp = ZONE_ROOTVP();
                 VN_HOLD(dvp);
 
                 DTRACE_NFSV3_5(op__lookup__start, struct svc_req *, req,
                     cred_t *, cr, vnode_t *, dvp, struct exportinfo *, exi,

@@ -477,10 +478,11 @@
          */
         if (PUBLIC_FH3(&args->what.dir)) {
                 publicfh_flag = TRUE;
 
                 exi_rele(exi);
+                exi = NULL;
 
                 error = rfs_publicfh_mclookup(name, dvp, cr, &vp,
                     &exi, &sec);
 
                 /*

@@ -560,11 +562,10 @@
         }
 
         va.va_mask = AT_ALL;
         vap = rfs4_delegated_getattr(vp, &va, 0, cr) ? NULL : &va;
 
-        exi_rele(exi);
         VN_RELE(vp);
 
         resp->status = NFS3_OK;
         vattr_to_post_op_attr(vap, &resp->resok.obj_attributes);
         vattr_to_post_op_attr(dvap, &resp->resok.dir_attributes);

@@ -579,10 +580,11 @@
 
         DTRACE_NFSV3_5(op__lookup__done, struct svc_req *, req,
             cred_t *, cr, vnode_t *, dvp, struct exportinfo *, exi,
             LOOKUP3res *, resp);
         VN_RELE(dvp);
+        exi_rele(exi);
 
         return;
 
 out:
         if (curthread->t_flag & T_WOULDBLOCK) {

@@ -2672,10 +2674,11 @@
         if (name == NULL) {
                 resp->status = NFS3ERR_INVAL;
                 goto err1;
         }
 
+        ASSERT3U(exi->exi_zoneid, ==, curzone->zone_id);
         error = VOP_RMDIR(vp, name, ZONE_ROOTVP(), cr, NULL, 0);
 
         if (name != args->object.name)
                 kmem_free(name, MAXPATHLEN + 1);