--- fs/unionfs/union_subr.c.sav	2016-08-11 18:20:10.585999000 -0400
+++ fs/unionfs/union_subr.c	2016-08-17 19:38:14.795023000 -0400
@@ -101,6 +101,23 @@ unionfs_get_hashhead(struct vnode *dvp, 
 }
 
 /*
+ * Clean up function for insmntque1().
+ * First, call unionfs_noderem() and then do the same as insmntque_stddtr().
+ * Maybe insmntque_stddtr() should become non-static, so I can just call
+ * it here?
+ */
+static void
+unionfs_insmntque_dtr(struct vnode *vp, void *dtr_arg)
+{
+
+	unionfs_noderem(vp, curthread);
+	vp->v_data = NULL;
+	vp->v_op = &dead_vnodeops;
+	vgone(vp);
+	vput(vp);
+}
+
+/*
  * Get the cached vnode.
  */
 static struct vnode *
@@ -255,11 +272,6 @@ unionfs_nodeget(struct mount *mp, struct
 		free(unp, M_UNIONFSNODE);
 		return (error);
 	}
-	error = insmntque(vp, mp);	/* XXX: Too early for mpsafe fs */
-	if (error != 0) {
-		free(unp, M_UNIONFSNODE);
-		return (error);
-	}
 	if (dvp != NULLVP)
 		vref(dvp);
 	if (uppervp != NULLVP)
@@ -293,6 +305,18 @@ unionfs_nodeget(struct mount *mp, struct
 	    (lowervp != NULLVP && ump->um_lowervp == lowervp))
 		vp->v_vflag |= VV_ROOT;
 
+	/*
+	 * Not sure if LK_RETRY is needed here?
+	 * Normally, this would be done with a lockmgr() call, but in
+	 * this case, v_vnlock is actually a vnode lock for either the
+	 * uppervp or lowervp, so I used the vn_lock() call.
+	 */
+	vn_lock(vp, LK_EXCLUSIVE | LK_RETRY);
+	error = insmntque1(vp, mp, unionfs_insmntque_dtr, NULL);
+	if (error != 0)
+		return (error);
+	VOP_UNLOCK(vp, 0);
+
 	if (path != NULL && dvp != NULLVP && vt == VDIR)
 		*vpp = unionfs_ins_cached_vnode(unp, dvp, path);
 	if ((*vpp) != NULLVP) {
@@ -314,6 +338,7 @@ unionfs_nodeget(struct mount *mp, struct
 
 unionfs_nodeget_out:
 	if (lkflags & LK_TYPE_MASK)
+		/* Should there be a check for VI_DOOMED here? */
 		vn_lock(vp, lkflags | LK_RETRY);
 
 	return (0);