Revert exi_zone to exi_zoneid, and install exi_ne backpointer
Caution with use after exi_rele()
Be far more judicious in the use of curzone-using macros.
(Merge and extra asserts by danmcd.)
curzone reality check and teardown changes to use the RIGHT zone
Try to remove assumption that zone's root vnode is marked VROOT

@@ -409,10 +409,11 @@
         /*
          * Allow lookups from the root - the default
          * location of the public filehandle.
          */
         if (exi != NULL && (exi->exi_export.ex_flags & EX_PUBLIC)) {
+                ASSERT3U(exi->exi_zoneid, ==, curzone->zone_id);
                 dvp = ZONE_ROOTVP();
                 VN_HOLD(dvp);
 
                 DTRACE_NFSV3_5(op__lookup__start, struct svc_req *, req,
                     cred_t *, cr, vnode_t *, dvp, struct exportinfo *, exi,

@@ -442,14 +443,15 @@
                 resp->status = NFS3ERR_ACCES;
                 goto out1;
         }
 
         fhp = &args->what.dir;
+        ASSERT3U(curzone->zone_id, ==, exi->exi_zoneid); /* exi is non-NULL */
         if (strcmp(args->what.name, "..") == 0 &&
             EQFID(&exi->exi_fid, FH3TOFIDP(fhp))) {
                 if ((exi->exi_export.ex_flags & EX_NOHIDE) &&
-                    (dvp->v_flag & VROOT)) {
+                    ((dvp->v_flag & VROOT) || VN_IS_CURZONEROOT(dvp))) {
                         /*
                          * special case for ".." and 'nohide'exported root
                          */
                         if (rfs_climb_crossmnt(&dvp, &exi, cr) != 0) {
                                 resp->status = NFS3ERR_ACCES;

@@ -476,10 +478,11 @@
          */
         if (PUBLIC_FH3(&args->what.dir)) {
                 publicfh_flag = TRUE;
 
                 exi_rele(exi);
+                exi = NULL;
 
                 error = rfs_publicfh_mclookup(name, dvp, cr, &vp,
                     &exi, &sec);
 
                 /*

@@ -559,11 +562,10 @@
         }
 
         va.va_mask = AT_ALL;
         vap = rfs4_delegated_getattr(vp, &va, 0, cr) ? NULL : &va;
 
-        exi_rele(exi);
         VN_RELE(vp);
 
         resp->status = NFS3_OK;
         vattr_to_post_op_attr(vap, &resp->resok.obj_attributes);
         vattr_to_post_op_attr(dvap, &resp->resok.dir_attributes);

@@ -578,10 +580,11 @@
 
         DTRACE_NFSV3_5(op__lookup__done, struct svc_req *, req,
             cred_t *, cr, vnode_t *, dvp, struct exportinfo *, exi,
             LOOKUP3res *, resp);
         VN_RELE(dvp);
+        exi_rele(exi);
 
         return;
 
 out:
         if (curthread->t_flag & T_WOULDBLOCK) {

@@ -1331,11 +1334,13 @@
         if (vp == NULL) {
                 error = ESTALE;
                 goto err;
         }
 
+        ASSERT3U(curzone->zone_id, ==, exi->exi_zoneid); /* exi is non-NULL. */
         ns = nfs3_get_srv();
+
         if (is_system_labeled()) {
                 bslabel_t *clabel = req->rq_label;
 
                 ASSERT(clabel != NULL);
                 DTRACE_PROBE2(tx__rfs3__log__info__opwrite__clabel, char *,

@@ -2669,10 +2674,11 @@
         if (name == NULL) {
                 resp->status = NFS3ERR_INVAL;
                 goto err1;
         }
 
+        ASSERT3U(exi->exi_zoneid, ==, curzone->zone_id);
         error = VOP_RMDIR(vp, name, ZONE_ROOTVP(), cr, NULL, 0);
 
         if (name != args->object.name)
                 kmem_free(name, MAXPATHLEN + 1);
 

@@ -4131,10 +4137,11 @@
         if (vp == NULL) {
                 error = ESTALE;
                 goto out;
         }
 
+        ASSERT3U(curzone->zone_id, ==, exi->exi_zoneid); /* exi is non-NULL. */
         ns = nfs3_get_srv();
         bva.va_mask = AT_ALL;
         error = VOP_GETATTR(vp, &bva, 0, cr, NULL);
 
         /*