Why are you not releasing the vnode of the starting directory when returning from namei()?

[eeropomell]

4.4BSD-Lite2/usr/src/sys/kern/vfs_lookup.c

Line 153 in 50587b0

if ((cnp->cn_flags & ISSYMLINK) == 0) {

If the result of lookup() is a not a symbolic link, you return instantly, so you don't release the vnode of the starting directory