--- kernel/bsd/kern/kern_descrip.c	2018/04/24 18:26:01	1.1
+++ kernel/bsd/kern/kern_descrip.c	2018/04/24 18:27:39	1.1.1.2
@@ -567,7 +567,8 @@ finishdup(fdp, old, new, retval)
 	}
 	fdp->fd_ofiles[new] = fp;
 	fdp->fd_ofileflags[new] = fdp->fd_ofileflags[old] &~ UF_EXCLOSE;
-	fp->f_count++;
+	if (++fp->f_count <= 0)
+		panic("finishdup f_count");
 	if (new > fdp->fd_lastfile)
 		fdp->fd_lastfile = new;
 	*retval = new;
@@ -919,9 +920,14 @@ ffree(fp)
 	register struct file *fp;
 {
 	register struct file *fq;
+	struct ucred *cred;
 
 	LIST_REMOVE(fp, f_list);
-	crfree(fp->f_cred);
+	cred = fp->f_cred;
+	if (cred != NOCRED) {
+		fp->f_cred = NOCRED;
+		crfree(cred);
+	}
 #if DIAGNOSTIC
 	fp->f_count = 0;
 #endif
@@ -1006,9 +1012,10 @@ fdcopy(p)
 		fpp = newfdp->fd_ofiles;
 		flags = newfdp->fd_ofileflags;
 		for (i = newfdp->fd_lastfile; i-- >= 0; fpp++, flags++)
-			if (*fpp != NULL && !(*flags & UF_RESERVED))
-				(*fpp)->f_count++;
-			else {
+			if (*fpp != NULL && !(*flags & UF_RESERVED)) {
+				if (++(*fpp)->f_count <= 0)
+					panic("fdcopy f_count");
+			} else {
 				*fpp = NULL; *flags = 0;
 			}
 	}
@@ -1226,7 +1233,8 @@ dupfdopen(fdp, indx, dfd, mode, error)
 		 */
 		if (((mode & (FREAD|FWRITE)) | wfp->f_flag) != wfp->f_flag)
 			return (EACCES);
-		wfp->f_count++;
+		if (++wfp->f_count <= 0)
+			panic("dupfdopen f_count");
 		if (indx > fdp->fd_lastfile)
 			fdp->fd_lastfile = indx;;
 		fdp->fd_ofiles[indx] = wfp;