6.1/amd64 NFS/UFS-related panic

[Edgar Fuß <ef%math.uni-bonn.de@localhost>]

On a 6.1_STABLE/amd NFS server, we got the following panic during some atypic
NFS requests:

uvm_fault(0xfffffe8419c47d58, 0x0, 1) -> e
fatal page fault in supervisor mode
trap type 6 code 0 rip ffffffff804226c1 cs 8 rflags 10246 cr2 c8 cpl rsp ffffe811da3e660
kernel: page fault trap, code=0
Stopped in pid 408.4 (nfsd) at netbsd:ufs_fhtovp+0x2e: cmpw $0,c8(%rdx)

ufs_fhtovp() at netbsd:ufs_fhtovp+0x2e
ffs_fhtovp() at netbsd:ffs_fhtovp+0x55
VFS-FHTOVP() at netbsd:VFS_FHTOVP+0x1c
nfsrv_fhtovp() at netbsd:nfsrv_fhtovp+0x9a
nfsrv_write() at netbsd:nfsrv_write+0x502
nfssvc_nfsd() at netbsd:nfssvc_nfsd+0x1d7
sys_nfssvc() at netbsd:sys_nfssvc+0x22c
syscall() at netbsd:syscall+0xc4

ds	e650
es	0
fs	210
gs	5000
rdi	fffffe80795c2088
rsi	1
rbp	fffffe811da4e680
rbx	fffffe811da4e690
rdx	0
rcx	fffffe8414fc1464
rax	0
r8	fffffe8514fc1460
r9	0
r10	0
r11	1
r12	fffffe811da3e958
r13	fffffe8141e39c00
r14	1
r15	fffffe84069c3e40
rip	ffffffff804226c1	ufs_fhtovp+0x2e
cs	8
rflags	10246
rsp	fffffe811da3e6660
ss	10
netbsd:ufs_fhtovp+0x2e: cmpw	$0,c8(%rdx)

Any hints?