Hyperaggressive asserts pt 2/N
Be far more judicious in the use of curzone-using macros.
(Merge and extra asserts by danmcd.)
dss_paths[] entries need cleanup too
Try to remove assumption that zone's root vnode is marked VROOT

@@ -816,12 +816,12 @@
         sip->dss_npaths = dss_npaths;
         sip->dss_paths = kmem_alloc(dss_npaths *
             sizeof (rfs4_dss_path_t *), KM_SLEEP);
 
         for (i = 0; i < dss_npaths; i++) {
-                /* CSTYLED */
-                sip->dss_paths[i] = rfs4_dss_newpath(nsrv4, sip, dss_paths[i], i);
+                sip->dss_paths[i] =
+                    rfs4_dss_newpath(nsrv4, sip, dss_paths[i], i);
         }
 
         mutex_enter(&nsrv4->servinst_lock);
         if (nsrv4->nfs4_cur_servinst != NULL) {
                 /* add to linked list */

@@ -855,13 +855,29 @@
         for (sip = current; sip != NULL; sip = prev) {
                 prev = sip->prev;
                 rw_destroy(&sip->rwlock);
                 if (sip->oldstate)
                         kmem_free(sip->oldstate, sizeof (rfs4_oldstate_t));
-                if (sip->dss_paths)
+                if (sip->dss_paths) {
+                        int i = sip->dss_npaths;
+
+                        while (i > 0) {
+                                i--;
+                                if (sip->dss_paths[i] != NULL) {
+                                        char *path = sip->dss_paths[i]->path;
+
+                                        if (path != NULL) {
+                                                kmem_free(path,
+                                                    strlen(path) + 1);
+                                        }
+                                        kmem_free(sip->dss_paths[i],
+                                            sizeof (rfs4_dss_path_t));
+                                }
+                        }
                         kmem_free(sip->dss_paths,
                             sip->dss_npaths * sizeof (rfs4_dss_path_t *));
+                }
                 kmem_free(sip, sizeof (rfs4_servinst_t));
 #ifdef DEBUG
                 n++;
 #endif
         }

@@ -935,11 +951,11 @@
 static nfsstat4
 do_rfs4_op_secinfo(struct compound_state *cs, char *nm, SECINFO4res *resp)
 {
         int error, different_export = 0;
         vnode_t *dvp, *vp;
-        struct exportinfo *exi = NULL;
+        struct exportinfo *exi;
         fid_t fid;
         uint_t count, i;
         secinfo4 *resok_val;
         struct secinfo *secp;
         seconfig_t *si;

@@ -946,24 +962,26 @@
         bool_t did_traverse = FALSE;
         int dotdot, walk;
         nfs_export_t *ne = nfs_get_export();
 
         dvp = cs->vp;
+        exi = cs->exi;
+        ASSERT(exi != NULL);
         dotdot = (nm[0] == '.' && nm[1] == '.' && nm[2] == '\0');
 
         /*
          * If dotdotting, then need to check whether it's above the
          * root of a filesystem, or above an export point.
          */
         if (dotdot) {
-
+                ASSERT3U(exi->exi_zoneid, ==, curzone->zone_id);
                 /*
                  * If dotdotting at the root of a filesystem, then
                  * need to traverse back to the mounted-on filesystem
                  * and do the dotdot lookup there.
                  */
-                if (cs->vp->v_flag & VROOT) {
+                if ((dvp->v_flag & VROOT) || VN_IS_CURZONEROOT(dvp)) {
 
                         /*
                          * If at the system root, then can
                          * go up no further.
                          */

@@ -971,11 +989,11 @@
                                 return (puterrno4(ENOENT));
 
                         /*
                          * Traverse back to the mounted-on filesystem
                          */
-                        dvp = untraverse(cs->vp);
+                        dvp = untraverse(dvp);
 
                         /*
                          * Set the different_export flag so we remember
                          * to pick up a new exportinfo entry for
                          * this new filesystem.

@@ -985,11 +1003,11 @@
 
                         /*
                          * If dotdotting above an export point then set
                          * the different_export to get new export info.
                          */
-                        different_export = nfs_exported(cs->exi, cs->vp);
+                        different_export = nfs_exported(exi, dvp);
                 }
         }
 
         /*
          * Get the vnode for the component "nm".

@@ -1004,13 +1022,13 @@
          * used in the request is valid but not an explicitly shared flavor,
          * or the access bit indicates that this is a limited access,
          * check whether this vnode is visible.
          */
         if (!different_export &&
-            (PSEUDO(cs->exi) || ! is_exported_sec(cs->nfsflavor, cs->exi) ||
+            (PSEUDO(exi) || !is_exported_sec(cs->nfsflavor, exi) ||
             cs->access & CS_ACCESS_LIMITED)) {
-                if (! nfs_visible(cs->exi, vp, &different_export)) {
+                if (! nfs_visible(exi, vp, &different_export)) {
                         VN_RELE(vp);
                         return (puterrno4(ENOENT));
                 }
         }
 

@@ -1048,10 +1066,11 @@
                 if (error) {
                         VN_RELE(vp);
                         return (puterrno4(error));
                 }
 
+                /* We'll need to reassign "exi". */
                 if (dotdot)
                         exi = nfs_vptoexi(NULL, vp, cs->cr, &walk, NULL, TRUE);
                 else
                         exi = checkexport4(&vp->v_vfsp->vfs_fsid, &fid, vp);
 

@@ -1068,12 +1087,10 @@
                         } else {
                                 VN_RELE(vp);
                                 return (puterrno4(EACCES));
                         }
                 }
-        } else {
-                exi = cs->exi;
         }
         ASSERT(exi != NULL);
 
 
         /*

@@ -2700,17 +2717,18 @@
          * If dotdotting, then need to check whether it's
          * above the root of a filesystem, or above an
          * export point.
          */
         if (dotdot) {
-
+                ASSERT(cs->exi != NULL);
+                ASSERT3U(cs->exi->exi_zoneid, ==, curzone->zone_id);
                 /*
                  * If dotdotting at the root of a filesystem, then
                  * need to traverse back to the mounted-on filesystem
                  * and do the dotdot lookup there.
                  */
-                if (cs->vp->v_flag & VROOT) {
+                if ((cs->vp->v_flag & VROOT) || VN_IS_CURZONEROOT(cs->vp)) {
 
                         /*
                          * If at the system root, then can
                          * go up no further.
                          */