this bug has so far been reproducible.

I have an nfs server running Debian lenny with the stock 2.6.26-2-686
kernel, and a client machine also running Debian lenny but with a
2.6.32.12 kernel (kernel config attached).

/etc/exports on the server, possibly bogus although the server never
complains and still probably shouldn't trigger a NULL dereference in 
the client:
  /stow *(ro,fsid=0,crossmnt,no_subtree_check)
  /stow -mp,ro,all_squash,async,no_subtree_check \
    199.125.85.51  \
    199.125.85.134 \
    66.55.209.223

/etc/fstab on the client:
  199.125.85.39:/stow /stow nfs4 noatime

the OOPS (attached below) occurs when attempting a mount from the client

  # mount /stow
  # echo $?
  2

the mount command never outputs but has a return code of 2 and the mount
is not successful.