8805 xattr_dir_lookup() can leak a vnode hold