Currently the code only bumps holdcnt and clears the VI_FREE flag, not performing actual vhold. Since the vnode is still visible elsewhere, a potential new user can find it and incorrectly assume it is properly held. Use vholdl to properly hold the vnode.
The other place recycling (vlrureclaim) does this already. This probably can be hacked to avoid most of the work, but that's for later.