in ufsdirhash_free(), only examine dh->dh_onlist after taking the
dirhashlist lock.  if we skip the lock then we might see that
dh_onlist is zero while ufsdirhash_recycle() is still working on
the dirhash.  the symptom I saw was that ufsdirhash_free() would
try to destroy the dh_lock mutex while it was still held.

(chs)