diff --git a/sys/kern/kern_exit.c b/sys/kern/kern_exit.c
index 2a99fd60..3ae5d4e3 100644
--- a/sys/kern/kern_exit.c
+++ b/sys/kern/kern_exit.c
@@ -308,9 +308,6 @@ exit1(int rv)
 		    WTERMSIG(rv), WEXITSTATUS(rv));
 		panic("Going nowhere without my init!");
 	}
-	varsymset_clean(&p->p_varsymset);
-	lockuninit(&p->p_varsymset.vx_lock);
-
 	/*
 	 * Kill all lwps associated with the current process, return an
 	 * error if we race another thread trying to do the same thing
@@ -322,6 +319,13 @@ exit1(int rv)
 		/* NOT REACHED */
 	}
 
+	/*
+	 * All other LWPs are gone, p_varsymset is no longer reachable by
+	 * sys_varsym_*(): clean and destroy it race-free now (DF-2908).
+	 */
+	varsymset_clean(&p->p_varsymset);
+	lockuninit(&p->p_varsymset.vx_lock);
+
 	/* are we a task leader? */
 	if (p == p->p_leader) {
 		struct sysmsg sysmsg;