It seems to be strongly related to the pmap locking protocol, rather
than the FS locking per se.

The old 1.3.2 mips (which followed the Mach pmap conventions for
setting dirty/reference bits) worked almost flawlessly with nullfs.

(iirc, I built the 1.3 and 1.3.2 binary distributions in a
nullfs-mounted directory).

Since updating the mips pmap to follow the (different) locking
conventions required by UVM, the same nullfs bugs reported elsewhere
appeared on a pmax.