Suppose an inode has been used and freed.
It is left marked I_VALID (the bug).
Now ialloc comes along and reuses the
inode.  It writes the new inode type to disk
and returns iget(dev, inum) to get the
cache entry.  Iget sees that the inode is valid
and doesn't bother refreshing from disk.
Now when the caller iupdates, it will write
out a zero type and the file or directory has
disappeared.