diff --git a/sys/kern/tty_tty.c b/sys/kern/tty_tty.c
--- a/sys/kern/tty_tty.c
+++ b/sys/kern/tty_tty.c
@@ -71,6 +71,13 @@
 	.d_kqfilter =	cttykqfilter
 };
 
+/*
+ * cttyvp() returns an unsynchronized snapshot of the controlling-tty
+ * vnode pointer.  Callers that dereference the result must either hold
+ * proc_token across the use or take a reference (vhold) before dropping
+ * any other locks, because writers in tty.c update s_ttyvp under
+ * proc_token.  See DF-0176/DF-0177.
+ */
 #define cttyvp(p) (((p)->p_flags & P_CONTROLT) ? \
 			(p)->p_session->s_ttyvp : NULL)