Created attachment 178439 [details]
In kern_unlinkat, VOP_REMOVE is invoked with invalid cn_nameptr, which was freed by iname.
Since the memory region at cn_nameptr is already freed while VOP_REMOVE, uma_zalloc with namei_zone may return a block overwrapping cn_nameptr.
Adding SAVENAME flag to NDINIT_ATRIGHTS(iname call) solves this problem.
Created attachment 178441 [details]
It seems kern_rmdirat has the same problem. Updated attached patch.