Hyperaggressive asserts pt 1/N
Ooops exi_zoneid isn't a variable again yet
Be far more judicious in the use of curzone-using macros.

@@ -717,17 +717,18 @@
 /*
  * For NFS V4.
  * Add or remove the newly exported or unexported security flavors of the
  * given exportinfo from its ancestors upto the system root.
  */
-void
+static void
 srv_secinfo_treeclimb(nfs_export_t *ne, exportinfo_t *exip, secinfo_t *sec,
     int seccnt, bool_t isadd)
 {
         treenode_t *tnode;
 
         ASSERT(RW_WRITE_HELD(&ne->exported_lock));
+        ASSERT3U(exip->exi_zoneid, ==, curzone->zone_id);
 
         /*
          * exi_tree can be null for the zone root
          * which means we're already at the "top"
          * and there's nothing more to "climb".

@@ -814,11 +815,10 @@
 export_link(nfs_export_t *ne, exportinfo_t *exi)
 {
         exportinfo_t **bckt;
 
         ASSERT(RW_WRITE_HELD(&ne->exported_lock));
-        ASSERT(exi->exi_zoneid == ne->ne_globals->nfs_zoneid);
 
         bckt = &ne->exptable[exptablehash(&exi->exi_fsid, &exi->exi_fid)];
         exp_hash_link(exi, fid_hash, bckt);
 
         bckt = &ne->exptable_path_hash[pkp_tab_hash(exi->exi_export.ex_path,

@@ -898,10 +898,11 @@
 void
 nfs_export_zone_init(nfs_globals_t *ng)
 {
         int i;
         nfs_export_t *ne;
+        zone_t *zone;
 
         ne = kmem_zalloc(sizeof (*ne), KM_SLEEP);
 
         rw_init(&ne->exported_lock, NULL, RW_DEFAULT, NULL);
 

@@ -922,13 +923,20 @@
         ne->exi_root->exi_export.ex_path[1] = '\0';
 
         ne->exi_root->exi_count = 1;
         mutex_init(&ne->exi_root->exi_lock, NULL, MUTEX_DEFAULT, NULL);
 
-        ASSERT(curzone->zone_id == ng->nfs_zoneid);
-        ne->exi_root->exi_vp = ZONE_ROOTVP();
-        ne->exi_root->exi_zoneid = ng->nfs_zoneid;
+        /*
+         * Because we cannot:
+         *      ASSERT(curzone->zone_id == ng->nfs_zoneid);
+         * We grab the zone pointer explicitly (like netstacks do) and
+         * set the rootvp here.
+         */
+        zone = zone_find_by_id_nolock(ng->nfs_zoneid);
+        ne->exi_root->exi_vp = zone->zone_rootvp;
+        ne->exi_root->exi_zone = zone;  /* XXX KEBE SAYS lose me, and... */
+        /* ne->exi_root->exi_zoneid = ng->nfs_zoneid; */ /* use me instead! */
 
         /*
          * Fill in ne->exi_rootfid later, in nfs_export_get_rootfid
          * because we can't correctly return errors here.
          */

@@ -1918,11 +1926,11 @@
                 newexi = pseudo_exportfs(ne, exi->exi_vp, &exi->exi_fid,
                     exi->exi_visible, &exi->exi_export);
                 exi->exi_visible = NULL;
 
                 /* interconnect the existing treenode with the new exportinfo */
-                newexi->exi_zone = exi->exi_zone;
+                newexi->exi_zone = exi->exi_zone; /* XXX KEBE SAYS LOSE ME */
                 newexi->exi_tree = exi->exi_tree;
                 newexi->exi_tree->tree_exi = newexi;
 
                 /* Update the change timestamp */
                 tree_update_change(ne, exi->exi_tree, NULL);

@@ -2187,10 +2195,11 @@
                 /*
                  * We have just failed finding a matching export.
                  * If we're at the root of this filesystem, then
                  * it's time to stop (with failure).
                  */
+                ASSERT3P(vp->v_vfsp->vfs_zone, ==, curzone);
                 if ((vp->v_flag & VROOT) || VN_IS_CURZONEROOT(vp)) {
                         error = EINVAL;
                         break;
                 }