diff --git a/sys/netgraph7/tty/ng_tty.c b/sys/netgraph7/tty/ng_tty.c
--- a/sys/netgraph7/tty/ng_tty.c
+++ b/sys/netgraph7/tty/ng_tty.c
@@ -588,12 +588,14 @@ ngt_rcvdata(hook_p hook, struct item *item)

 	NGI_GET_M(item, m);
 	NG_FREE_ITEM(item);
-
+	lwkt_gettoken(&tp->t_token);	/* DF-0636: protect outq access */
 	if (IF_QFULL(&sc->outq)) {
 		IF_DROP(&sc->outq);
 		NG_FREE_M(m);
+		lwkt_reltoken(&tp->t_token);
 		return (ENOBUFS);
 	}

 	IF_ENQUEUE(&sc->outq, m);
 	qlen = sc->outq.ifq_len;
@@ -601,9 +603,6 @@ ngt_rcvdata(hook_p hook, struct item *item)
 	/*
 	 * If qlen > 1, then we should already have a scheduled callout.
 	 */
-	if (qlen == 1) {
-		lwkt_gettoken(&tp->t_token);
-		ngt_start(sc->tp);
-		lwkt_reltoken(&tp->t_token);
-	}
+	if (qlen == 1)
+		ngt_start(sc->tp);
+	lwkt_reltoken(&tp->t_token);

 	return (0);