I'm glad to report that this unionfs, not the one in 2.6.24-rc2-mm1 but the one including those 9 patches you posted, now gets through my testing with tmpfs without a problem. I do still get occasional "unionfs: new lower inode mtime (bindex=0, name=<directory>)" messages, but nothing worse seen yet: a big improvement. I deceived myself for a while that the danger of shmem_writepage hitting its BUG_ON(entry->val) was dealt with too; but that's wrong, I must go back to working out an escape ...