XNU has a race condition leading to use-after-free between the NFSSVC_NFSD command and an upcall worker thread.