Caution with use after exi_rele()
Ooops exi_zoneid isn't a variable again yet
Be far more judicious in the use of curzone-using macros.

@@ -164,14 +164,15 @@
         exi->exi_vp = vp;
         VN_HOLD(exi->exi_vp);
         exi->exi_visible = vis_head;
         exi->exi_count = 1;
         /* Caller will set exi_zone... */
+        /* XXX KEBE SAYS Uncomment me or fix in the caller */
+        /* exi->exi_zoneid = ne->ne_globals->nfs_zoneid; */
         exi->exi_volatile_dev = (vfssw[vp->v_vfsp->vfs_fstype].vsw_flag &
             VSW_VOLATILEDEV) ? 1 : 0;
         mutex_init(&exi->exi_lock, NULL, MUTEX_DEFAULT, NULL);
-        exi->exi_zoneid = ne->ne_globals->nfs_zoneid;
 
         /*
          * Build up the template fhandle
          */
         exi->exi_fh.fh_fsid = fsid;

@@ -658,10 +659,11 @@
                 fid.fid_len = MAXFIDSZ;
                 error = vop_fid_pseudo(vp, &fid);
                 if (error)
                         break;
 
+                ASSERT3U(exip->exi_zoneid, ==, curzone->zone_id);
                 /*
                  * The root of the file system, or the zone's root for
                  * in-zone NFS service needs special handling
                  */
                 if (vp->v_flag & VROOT || VN_IS_CURZONEROOT(vp)) {

@@ -694,10 +696,11 @@
                                  * this as a pseudo export so that an NFS v4
                                  * client can do lookups in it.
                                  */
                                 new_exi = pseudo_exportfs(ne, vp, &fid,
                                     vis_head, NULL);
+                                /* XXX KEBE SAYS NUKE ME */
                                 new_exi->exi_zone = exip->exi_zone;
                                 vis_head = NULL;
                         }
 
                         if (VN_IS_CURZONEROOT(vp)) {

@@ -878,10 +881,11 @@
                         mutex_enter(&nfs_exi_id_lock);
                         avl_remove(&exi_id_tree, tnode->tree_exi);
                         mutex_exit(&nfs_exi_id_lock);
                         export_unlink(ne, tnode->tree_exi);
                         exi_rele(tnode->tree_exi);
+                        tnode->tree_exi = NULL;
                 }
 
                 /* Release visible in parent's exportinfo */
                 if (tnode->tree_vis != NULL)
                         less_visible(vis2exi(tnode), tnode->tree_vis);

@@ -905,10 +909,12 @@
 
 /*
  * Traverse backward across mountpoint from the
  * root vnode of a filesystem to its mounted-on
  * vnode.
+ *
+ * Callers to this function have confirmed the use of curzone is safe here.
  */
 vnode_t *
 untraverse(vnode_t *vp)
 {
         vnode_t *tvp, *nextvp;

@@ -961,11 +967,11 @@
  * where c is in the same filesystem as a.
  * So, get_root_export(*exportinfo_for_c) returns exportinfo_for_a
  *
  * If d is shared, then c will be put into a's visible list.
  * Note: visible list is per filesystem and is attached to the
- * VROOT exportinfo.
+ * VROOT exportinfo.  Returned exi does NOT have a new hold.
  */
 struct exportinfo *
 get_root_export(struct exportinfo *exip)
 {
         treenode_t *tnode = exip->exi_tree;