Hammer PFS weirdness when encrypting root

[Tim Darby]

I ran into a weird issue while building an encrypted root filesystem.  I used the script below to build the encrypted root.  Right after this runs, "ls /mnt/usr" and "ls /mnt/var" show the expected files and directories.  However, if I unmount root and remount it, I find that the contents of /usr and /var have swapped.  I can easily fix it by renaming /pfs/usr to /pfs/var and vice versa.  The script works fine on a non-encrypted root, so I'm wondering if it is somehow related to the mapper.  I'm running 2.9.1.176.
kldload dmcryptsetup -y luksFormat /dev/da1s1dcryptsetup luksOpen /dev/da1s1d root || exit 1newfs_hammer -L ROOT /dev/mapper/root

mount_hammer /dev/mapper/root /mntmkdir /mnt/bootmount /dev/da0s1a /mnt/bootmkdir /mnt/pfshammer pfs-master /mnt/pfs/usrhammer pfs-master /mnt/pfs/usr.obj

hammer pfs-master /mnt/pfs/varhammer pfs-master /mnt/pfs/var.crashhammer pfs-master /mnt/pfs/var.tmphammer pfs-master /mnt/pfs/tmphammer pfs-master /mnt/pfs/home

mkdir /mnt/usrmkdir /mnt/varmkdir /mnt/tmpmkdir /mnt/homemount_null /mnt/pfs/usr /mnt/usrmount_null /mnt/pfs/var /mnt/varmount_null /mnt/pfs/tmp /mnt/tmp

mount_null /mnt/pfs/home /mnt/homemkdir /mnt/usr/objmkdir /mnt/var/tmpmkdir /mnt/var/crashmount_null /mnt/pfs/var.tmp /mnt/var/tmp
mount_null /mnt/pfs/var.crash /mnt/var/crash
mount_null /mnt/pfs/usr.obj /mnt/usr/objchmod 1777 /mnt/tmpchmod 1777 /mnt/var/tmpcpdup -o / /mntcpdup -o /boot /mnt/bootcpdup -o /usr /mnt/usr

cpdup -o /var /mnt/varcpdup -i0 /etc /mnt/etcchflags -R nohistory /mnt/tmpchflags -R nohistory /mnt/var/tmpchflags -R nohistory /mnt/var/crashchflags -R nohistory /mnt/usr/obj