For some reason, fh_size isn't always initialized (in my tests, it was zero on some nfs lockd requests). The result is that fh_verify fails. Don't know where it really deserves to be initialized, but the rest of the fh appears to be properly initialized (setting the fh_size=NFS_FHSIZE allows the request to flow normally).
Alan, please comment
Old bug