Add KASSERT to ensure sane nsid.

All callers are currently filtering bad nsid to this function,
however, we'll have undefined behavior if that's not true. Add the
KASSERT to prevent that.

(cherry picked from commit d5cc572ce6009993fb3c4f6c887194b9ec3c9815)