---  sys/kern/vfs_subr.c.orig
+++  sys/kern/vfs_subr.c
@@ -376,6 +376,7 @@
 
 	MNT_ILOCK(mp);
 	MNT_REL(mp);
+	KASSERT(mp->mnt_lockref > 0, ("negative mnt_lockref"));
 	mp->mnt_lockref--;
 	if (mp->mnt_lockref == 0 && (mp->mnt_kern_flag & MNTK_DRAINING) != 0) {
 		MPASS(mp->mnt_kern_flag & MNTK_UNMOUNT);


---  sys/sys/mount.h.orig
+++  sys/sys/mount.h
@@ -206,6 +206,7 @@
 #define	MNT_MTX(mp)	(&(mp)->mnt_mtx)
 #define	MNT_REF(mp)	(mp)->mnt_ref++
 #define	MNT_REL(mp)	do {						\
+	KASSERT((mp)->mnt_ref > 0, ("negative mnt_ref"));			\
 	(mp)->mnt_ref--;						\
 	if ((mp)->mnt_ref == 0)						\
 		wakeup((mp));						\