cnp->cn_namelen already holds cp - cnp->cn_nameptr from a few lines
above. No need for size_t len here.


Index: sys/kern/vfs_lookup.c
===================================================================
RCS file: /cvs/src/sys/kern/vfs_lookup.c,v
diff -u -p -u -r1.91 vfs_lookup.c
--- sys/kern/vfs_lookup.c	3 Mar 2026 17:43:40 -0000	1.91
+++ sys/kern/vfs_lookup.c	1 Apr 2026 00:33:13 -0000
@@ -473,12 +473,12 @@ dirloop:
 	*cp = c; }
 #endif
 	if (cnp->cn_flags & REALPATH) {
-		size_t len = cp - cnp->cn_nameptr;
-		if (len == 2 && cnp->cn_nameptr[0] == '.' &&
+		if (cnp->cn_namelen == 2 && cnp->cn_nameptr[0] == '.' &&
 		    cnp->cn_nameptr[1] == '.')
 			component_pop(cnp);
-		else if (!(len == 1 && cnp->cn_nameptr[0] == '.')) {
-			if (!component_push(cnp, cnp->cn_nameptr, len)) {
+		else if (!(cnp->cn_namelen == 1 && cnp->cn_nameptr[0] == '.')) {
+			if (!component_push(cnp, cnp->cn_nameptr,
+			    cnp->cn_namelen)) {
 				error = ENAMETOOLONG;
 				goto bad;
 			}