diff --git a/sys/fs/nfsserver/nfs_nfsdsubs.c b/sys/fs/nfsserver/nfs_nfsdsubs.c
--- a/sys/fs/nfsserver/nfs_nfsdsubs.c
+++ b/sys/fs/nfsserver/nfs_nfsdsubs.c
@@ -1620,7 +1620,7 @@
 	if (nd->nd_cred->cr_uid == 0)
 		goto out;
 	if ((NFSVNO_ISSETUID(nvap) && nvap->na_uid != nd->nd_cred->cr_uid) ||
-	    (NFSVNO_ISSETGID(nvap) && nvap->na_gid != nd->nd_cred->cr_gid &&
+	    (NFSVNO_ISSETGID(nvap) &&
 	    !groupmember(nvap->na_gid, nd->nd_cred)))
 		error = NFSERR_PERM;
 
@@ -1679,8 +1679,7 @@
 	}
 	if (NFSISSET_ATTRBIT(attrbitp, NFSATTRBIT_OWNERGROUP) &&
 	    NFSVNO_ISSETGID(nvap)) {
-		if (nvap->na_gid == nd->nd_cred->cr_gid ||
-		    groupmember(nvap->na_gid, nd->nd_cred)) {
+		if (groupmember(nvap->na_gid, nd->nd_cred)) {
 			nd->nd_cred->cr_uid = 0;
 			nva.na_gid = nvap->na_gid;
 			change++;
diff --git a/sys/kern/kern_prot.c b/sys/kern/kern_prot.c
--- a/sys/kern/kern_prot.c
+++ b/sys/kern/kern_prot.c
@@ -1310,6 +1310,13 @@
 groupmember(gid_t gid, struct ucred *cred)
 {
 
+	/*
+	 * The nfsd server can use a credential with zero groups in it
+	 * when certain mapped export credentials are specified via exports(5).
+	 */
+	if (cred->cr_ngroups == 0)
+		return (false);
+
 	if (gid == cred->cr_groups[0])
 		return (true);