All attempts to refer to any file under the mounted portal file system end up waiting indefinitely.
Actually the portal ends up reading STDIN while it should be reading from a command.
E.g. the following command should simply list the output from who, but instead it does nothing until ctrl-D is given on the tty...

cat /p/pipe/usr/bin/who

At the same time the following complaint gets written to syslog...

May  5 15:28:36 sleipnir kernel: portal_open: 1 extra fds

Apparently the faulty takes place and gets also partially handled within the following snippet of code in portal_vnops.c ...

        cmsg = mtod(cm, struct cmsghdr *);
        newfds = (cmsg->cmsg_len - sizeof(*cmsg)) / sizeof (int);
        if (newfds == 0) {
                error = ECONNREFUSED;
                goto bad;
        }
        /*
         * At this point the rights message consists of a control message
         * header, followed by a data region containing a vector of
         * integer file descriptors.  The fds were allocated by the action
         * of receiving the control message.
         */
        ip = (int *) (cmsg + 1);
        fd = *ip++;
        if (newfds > 1) {
                /*
                 * Close extra fds.
                 */
                int i;
                printf("portal_open: %d extra fds\n", newfds - 1);
                for (i = 1; i < newfds; i++) {
                        portal_closefd(td, *ip);
                        ip++;
                }
        }

It seems that newfds gets calculated wrong and fd gets picked too early in the message.
After that the correct fd gets treated as extra and closed.

Fix: 

Apparently some further jugglery with the control message is needed to get the data alignment right.
At the time of this writing I do not have a patch.
How-To-Repeat: See full description above.