Filesystem access from a KLD causes "vrele: negative ref cnt" panic

[Sebastien]

Hello,
When the following kernel code has been run :

------------------------
  struct thread *td = curthread;
  struct nameidata nd;
  int flags, resid;
  struct vattr vat;

  /* Some threads don't have a current working directory, set this to avoid a 
page fault on vn_open() call */
  if(td->td_proc->p_fd->fd_rdir == NULL) td->td_proc->p_fd->fd_rdir = 
rootvnode;
  if(td->td_proc->p_fd->fd_cdir == NULL) td->td_proc->p_fd->fd_cdir = 
rootvnode;
  NDINIT(&nd, LOOKUP, FOLLOW, UIO_SYSSPACE, &filename[0], td);
  flags = FREAD;
  vn_open(&nd, &flags, 0, -1);
  NDFREE(&nd, NDF_ONLY_PNBUF);
  /* Get the file size. */
  VOP_GETATTR(nd.ni_vp, &vat, td->td_ucred, td);
  VOP_UNLOCK(nd.ni_vp, 0, td);
  vn_rdwr(UIO_READ, nd.ni_vp, buf, vat.va_size, 0, UIO_SYSSPACE, 
IO_NODELOCKED, td->td_ucred, NOCRED, &resid, td);
  vn_close(nd.ni_vp, FREAD, td->td_ucred, td);
------------------------

I have a random panic "vrele: negative ref cnt" when I shutdown the system. Am 
I double-freeing something in my code ? The fact that the panic is caused 
randomly suggests there is a synchronization problem - but the above code is 
always running under the protection of the Giant mutex.
Regards,
Sebastien

PS: This was previously posted on freebsd-fs, but got no answers.