Suppose an inode has been used and freed. It is left marked I_VALID (the bug). Now ialloc comes along and reuses the inode. It writes the new inode type to disk and returns iget(dev, inum) to get the cache entry. Iget sees that the inode is valid and doesn't bother refreshing from disk. Now when the caller iupdates, it will write out a zero type and the file or directory has disappeared.