From owner-freebsd-hackers  Fri Sep  8 17:50:05 1995
Return-Path: hackers-owner
Received: (from majordom@localhost)
          by freefall.freebsd.org (8.6.12/8.6.6) id RAA19941
          for hackers-outgoing; Fri, 8 Sep 1995 17:50:05 -0700
Received: (from julian@localhost)
          by freefall.freebsd.org (8.6.12/8.6.6) id RAA19932
          ; Fri, 8 Sep 1995 17:50:04 -0700
Date: Fri, 8 Sep 1995 17:50:04 -0700
From: Julian Elischer <julian>
Message-Id: <199509090050.RAA19932@freefall.freebsd.org>
To: davidg, hackers
Subject: bug in 4.4lite (fixed in lite2)
Sender: hackers-owner@FreeBSD.org
Precedence: bulk

while we are updating..
here's one to not miss:

in ufs/ufs/ufs_vnops.c:

        if (fvp == tvp) {
                if (fvp->v_type == VDIR) {
                        error = EINVAL;
                        goto abortit;
                }
                VOP_ABORTOP(fdvp, fcnp);
                vrele(fdvp);
                vrele(fvp);
                vput(tdvp);
                vput(tvp);
                tcnp->cn_flags &= ~MODMASK;
                tcnp->cn_flags |= LOCKPARENT | LOCKLEAF;
                if ((tcnp->cn_flags & SAVESTART) == 0)
                        panic("ufs_rename: lost from startdir");
                tcnp->cn_nameiop = DELETE;
                (void) relookup(tdvp, &tvp, tcnp);
                return (VOP_REMOVE(tdvp, tvp, tcnp));
        }

is back to front.. all the t (to) variables should be f (from) and visa versa.

touch a
ln a b
mv a b

results in a  remaining and b being deleted

in lite2
        if (fvp == tvp) {
                if (fvp->v_type == VDIR) {
                        error = EINVAL;
                        goto abortit;
                }

                /* Release destination completely. */
                VOP_ABORTOP(tdvp, tcnp);
                vput(tdvp);
                vput(tvp);

                /* Delete source. */
                vrele(fdvp);
                vrele(fvp);
                fcnp->cn_flags &= ~MODMASK;
                fcnp->cn_flags |= LOCKPARENT | LOCKLEAF;
                if ((fcnp->cn_flags & SAVESTART) == 0)
                        panic("ufs_rename: lost from startdir");
                fcnp->cn_nameiop = DELETE;
                (void) relookup(fdvp, &fvp, fcnp);
                return (VOP_REMOVE(fdvp, fvp, fcnp));
        }

get's it right..
I just noticed this when adding rename to devfs..
but 4.4l2 noticed before me :)