diff --git a/sys/kern/uipc_domain.c b/sys/kern/uipc_domain.c
--- a/sys/kern/uipc_domain.c
+++ b/sys/kern/uipc_domain.c
@@ -134,6 +134,13 @@
 {
 	struct domain *dp = data;
 
+	/*
+	 * The domain list is mutated only here (boot / kldload) under crit_enter().
+	 * Readers (pffindtype/pffindproto/kpfctlinput/kpfctlinput_direct) traverse the
+	 * list without synchronization; on DragonFly the net stack is serialized so a
+	 * reader sees at worst a stale-but-valid dom_next pointer. A full fix would add
+	 * a token around the readers as well.
+	 */
 	crit_enter();
 	SLIST_INSERT_HEAD(&domains, dp, dom_next);
 	crit_exit();