From Ian Kent (raven at themaw) dot net:

From Ian Kent (raven at themaw) dot net:
In amfs_mount() the function get_root_nfs_fh() is assumed to return an
NFSv2 handle but, if nfs_dispatcher != 2 it will write an NFSv3 handle
to the NFSv2 structure, possibly overflowing the variable.