diff --git a/sys/netgraph7/bluetooth/socket/ng_btsocket_l2cap.c b/sys/netgraph7/bluetooth/socket/ng_btsocket_l2cap.c
--- a/sys/netgraph7/bluetooth/socket/ng_btsocket_l2cap.c
+++ b/sys/netgraph7/bluetooth/socket/ng_btsocket_l2cap.c
@@ -2767,7 +2767,15 @@
 	KKASSERT(lockowned(&pcb->pcb_lock) != 0);
 
 	if (pcb->flags & NG_BTSOCKET_L2CAP_TIMO) {
-		callout_stop(&pcb->timo);
+		/*
+		 * Use the async variant: callout_stop() blocks until any
+		 * in-progress callback finishes, but the callback
+		 * (ng_btsocket_l2cap_process_timeout) needs pcb_lock --
+		 * which we hold -- producing a deadlock.  callout_stop_async()
+		 * requests cancellation without waiting; the flag clear
+		 * below makes the soon-to-be-prevented callback a no-op.
+		 */
+		callout_stop_async(&pcb->timo);
 		pcb->flags &= ~NG_BTSOCKET_L2CAP_TIMO;
 	} else
 		KASSERT(0,