Do rfs4_ss_fini() BEFORE rfs4_servinst_destroy_all().

@@ -1494,10 +1494,18 @@
         nfs4_srv_t *nsrv4;
         nsrv4 = zone_getspecific(rfs4_zone_key, curzone);
 
         rfs4_set_deleg_policy(nsrv4, SRV_NEVER_DELEGATE);
 
+        /*
+         * Clean up any dangling stable storage structures BEFORE calling
+         * rfs4_servinst_destroy_all() so there are no dangling structures
+         * (i.e. the srvinsts are all cleared of danglers BEFORE they get
+         * freed).
+         */
+        rfs4_ss_fini(nsrv4);
+
         mutex_enter(&nsrv4->state_lock);
 
         if (nsrv4->nfs4_server_state == NULL) {
                 mutex_exit(&nsrv4->state_lock);
                 return;

@@ -1534,13 +1542,10 @@
         nsrv4->rfs4_lockowner_cache_time = 0;
         nsrv4->rfs4_file_cache_time = 0;
         nsrv4->rfs4_deleg_state_cache_time = 0;
 
         mutex_exit(&nsrv4->state_lock);
-
-        /* clean up any dangling stable storage structures */
-        rfs4_ss_fini(nsrv4);
 }
 
 typedef union {
         struct {
                 uint32_t start_time;