[PATCH 11/28] Stricter checking for nsholder.c