Index: ffs/ffs_alloc.c
===================================================================
--- ffs/ffs_alloc.c	(revision 187777)
+++ ffs/ffs_alloc.c	(working copy)
@@ -1849,7 +1849,7 @@
 	struct cdev *dev;
 
 	cg = dtog(fs, bno);
-	if (devvp->v_type != VCHR) {
+	if (devvp->v_type != VCHR && devvp->v_type != VBAD) {
 		/* devvp is a snapshot */
 		dev = VTOI(devvp)->i_devvp->v_rdev;
 		cgblkno = fragstoblks(fs, cgtod(fs, cg));
@@ -1894,7 +1894,7 @@
 	if (size == fs->fs_bsize) {
 		fragno = fragstoblks(fs, cgbno);
 		if (!ffs_isfreeblock(fs, blksfree, fragno)) {
-			if (devvp->v_type != VCHR) {
+			if (devvp->v_type != VCHR && devvp->v_type != VBAD) {
 				UFS_UNLOCK(ump);
 				/* devvp is a snapshot */
 				brelse(bp);
@@ -2047,7 +2047,7 @@
 	struct cdev *dev;
 
 	cg = ino_to_cg(fs, ino);
-	if (devvp->v_type != VCHR) {
+	if (devvp->v_type != VCHR && devvp->v_type != VBAD) {
 		/* devvp is a snapshot */
 		dev = VTOI(devvp)->i_devvp->v_rdev;
 		cgbno = fragstoblks(fs, cgtod(fs, cg));
@@ -2113,7 +2113,7 @@
 	u_int8_t *inosused;
 
 	cg = ino_to_cg(fs, ino);
-	if (devvp->v_type != VCHR) {
+	if (devvp->v_type != VCHR && devvp->v_type != VBAD) {
 		/* devvp is a snapshot */
 		cgbno = fragstoblks(fs, cgtod(fs, cg));
 	} else {