Index: sys/kern/vfs_lookup.c
===================================================================
--- sys/kern/vfs_lookup.c
+++ sys/kern/vfs_lookup.c
@@ -454,7 +454,16 @@
 			    &dfp, &ndp->ni_filecaps);
 			if (error != 0 || dfp->f_ops == &badfileops ||
 			    dfp->f_vnode == NULL) {
-				error = ENOTDIR;
+				/*
+				 * fget_cap_locked will return either EBADF or a
+				 * capability-related error; both of these are
+				 * OK to preserve, we just need to set the error
+				 * for our other erroneous conditions.
+				 */
+				if (error == 0 && dfp->f_vnode == NULL)
+					error = ENOTDIR;
+				else if (error == 0)
+					error = EBADF;
 			} else {
 				dp = dfp->f_vnode;
 				vrefact(dp);