struct ucred gets refed and unrefed all the time. falloc_install during buildkernel accounts for 1740339 calls, almost all of which use the same creds.
Reduce ping pong by providing a wrapper structure allocated on fork which can be referenced by threads in given process. This opens up reduction of the refing cost in the vm as well.
Note the current code contains an avoidable ref on td_ucred/p_ucred which can be eliminated later.