3743 zfs needs a refcount audit
Submitted by:   Will Andrews <willa@spectralogic.com>
Submitted by:   Justin Gibbs <justing@spectralogic.com>
Reviewed by:    Matthew Ahrens <mahrens@delphix.com>
Reviewed by:    Eric Schrock <eric.schrock@delphix.com>
Reviewed by:    George Wilson <george.wilson@delphix.com>

@@ -293,10 +293,11 @@
                 blk = (idx*2) >> (bs-3);
 
                 err = dmu_buf_hold(zap->zap_objset, zap->zap_object,
                     (tbl->zt_nextblk + blk) << bs, FTAG, &db,
                     DMU_READ_NO_PREFETCH);
+                if (err == 0)
                 dmu_buf_rele(db, FTAG);
         }
         return (err);
 }
 

@@ -990,72 +991,81 @@
 {
         zap_cursor_t zc;
         zap_attribute_t za;
         int err;
 
+        err = 0;
         for (zap_cursor_init(&zc, os, fromobj);
             zap_cursor_retrieve(&zc, &za) == 0;
             (void) zap_cursor_advance(&zc)) {
-                if (za.za_integer_length != 8 || za.za_num_integers != 1)
-                        return (SET_ERROR(EINVAL));
+                if (za.za_integer_length != 8 || za.za_num_integers != 1) {
+                        err = SET_ERROR(EINVAL);
+                        break;
+                }
                 err = zap_add(os, intoobj, za.za_name,
                     8, 1, &za.za_first_integer, tx);
                 if (err)
-                        return (err);
+                        break;
         }
         zap_cursor_fini(&zc);
-        return (0);
+        return (err);
 }
 
 int
 zap_join_key(objset_t *os, uint64_t fromobj, uint64_t intoobj,
     uint64_t value, dmu_tx_t *tx)
 {
         zap_cursor_t zc;
         zap_attribute_t za;
         int err;
 
+        err = 0;
         for (zap_cursor_init(&zc, os, fromobj);
             zap_cursor_retrieve(&zc, &za) == 0;
             (void) zap_cursor_advance(&zc)) {
-                if (za.za_integer_length != 8 || za.za_num_integers != 1)
-                        return (SET_ERROR(EINVAL));
+                if (za.za_integer_length != 8 || za.za_num_integers != 1) {
+                        err = SET_ERROR(EINVAL);
+                        break;
+                }
                 err = zap_add(os, intoobj, za.za_name,
                     8, 1, &value, tx);
                 if (err)
-                        return (err);
+                        break;
         }
         zap_cursor_fini(&zc);
-        return (0);
+        return (err);
 }
 
 int
 zap_join_increment(objset_t *os, uint64_t fromobj, uint64_t intoobj,
     dmu_tx_t *tx)
 {
         zap_cursor_t zc;
         zap_attribute_t za;
         int err;
 
+        err = 0;
         for (zap_cursor_init(&zc, os, fromobj);
             zap_cursor_retrieve(&zc, &za) == 0;
             (void) zap_cursor_advance(&zc)) {
                 uint64_t delta = 0;
 
-                if (za.za_integer_length != 8 || za.za_num_integers != 1)
-                        return (SET_ERROR(EINVAL));
+                if (za.za_integer_length != 8 || za.za_num_integers != 1) {
+                        err = SET_ERROR(EINVAL);
+                        break;
+                }
 
                 err = zap_lookup(os, intoobj, za.za_name, 8, 1, &delta);
                 if (err != 0 && err != ENOENT)
-                        return (err);
+                        break;
                 delta += za.za_first_integer;
                 err = zap_update(os, intoobj, za.za_name, 8, 1, &delta, tx);
                 if (err)
-                        return (err);
+                        break;
         }
         zap_cursor_fini(&zc);
-        return (0);
+        return (err);
 }
 
 int
 zap_add_int(objset_t *os, uint64_t obj, uint64_t value, dmu_tx_t *tx)
 {