diff -urN current/sys/ufs/ffs/ffs_vnops.c nfs4acl/sys/ufs/ffs/ffs_vnops.c
--- current/sys/ufs/ffs/ffs_vnops.c	2008-08-26 14:18:15.000000000 +0200
+++ nfs4acl/sys/ufs/ffs/ffs_vnops.c	2008-09-02 16:23:28.000000000 +0200
@@ -1409,7 +1409,7 @@
 		return (EROFS);
 
 	error = extattr_check_cred(ap->a_vp, ap->a_attrnamespace,
-	    ap->a_cred, ap->a_td, IWRITE);
+	    ap->a_cred, ap->a_td, VWRITE);
 	if (error) {
 		if (ip->i_ea_area != NULL && ip->i_ea_error == 0)
 			ip->i_ea_error = error;
@@ -1493,7 +1493,7 @@
 		return (EOPNOTSUPP);
 
 	error = extattr_check_cred(ap->a_vp, ap->a_attrnamespace,
-	    ap->a_cred, ap->a_td, IREAD);
+	    ap->a_cred, ap->a_td, VREAD);
 	if (error)
 		return (error);
 
@@ -1553,7 +1553,7 @@
 		return (EOPNOTSUPP);
 
 	error = extattr_check_cred(ap->a_vp, ap->a_attrnamespace,
-	    ap->a_cred, ap->a_td, IREAD);
+	    ap->a_cred, ap->a_td, VREAD);
 	if (error)
 		return (error);
 
@@ -1633,7 +1633,7 @@
 		return (EROFS);
 
 	error = extattr_check_cred(ap->a_vp, ap->a_attrnamespace,
-	    ap->a_cred, ap->a_td, IWRITE);
+	    ap->a_cred, ap->a_td, VWRITE);
 	if (error) {
 		if (ip->i_ea_area != NULL && ip->i_ea_error == 0)
 			ip->i_ea_error = error;
diff -urN current/sys/ufs/ufs/ufs_extattr.c nfs4acl/sys/ufs/ufs/ufs_extattr.c
--- current/sys/ufs/ufs/ufs_extattr.c	2008-08-26 14:18:15.000000000 +0200
+++ nfs4acl/sys/ufs/ufs/ufs_extattr.c	2008-09-02 16:23:29.000000000 +0200
@@ -847,7 +847,7 @@
 	if (strlen(name) == 0)
 		return (EINVAL);
 
-	error = extattr_check_cred(vp, attrnamespace, cred, td, IREAD);
+	error = extattr_check_cred(vp, attrnamespace, cred, td, VREAD);
 	if (error)
 		return (error);
 
@@ -1054,7 +1054,7 @@
 	if (!ufs_extattr_valid_attrname(attrnamespace, name))
 		return (EINVAL);
 
-	error = extattr_check_cred(vp, attrnamespace, cred, td, IWRITE);
+	error = extattr_check_cred(vp, attrnamespace, cred, td, VWRITE);
 	if (error)
 		return (error);
 
@@ -1162,7 +1162,7 @@
 	if (!ufs_extattr_valid_attrname(attrnamespace, name))
 		return (EINVAL);
 
-	error = extattr_check_cred(vp, attrnamespace, cred, td, IWRITE);
+	error = extattr_check_cred(vp, attrnamespace, cred, td, VWRITE);
 	if (error)
 		return (error);