# DF-3402 — if_sl: slstart drains sc_fastq/ifsq under the tty locks while sloutput fills them under the ifsq serializer (no common lock)

## What

`sys/net/sl/if_sl.c` shares two packet queues between two lock domains
that never intersect:

* **Producer** — `sloutput_serialized` (`:451-507`), running under the
  interface's hardware serializer (`sloutput` `:516`
  `ifsq_serialize_hw`): `IF_ENQUEUE(&sc->sc_fastq, m)` (`:494`) and
  `ifsq_enqueue(ifsq, m)` (`:498`). Holds **no tty token**.
* **Consumer** — `slstart` (`:529-713`), invoked from the tty drain
  path (e.g. sio's `siopoll` under `tty_token`,
  `sys/dev/serial/sio/sio.c:2241`) or from `sl_outfill`
  (`:1040-1060`): `IF_DEQUEUE(&sc->sc_fastq, m)` (`:568`) and
  `ifsq_dequeue(ifsq)` (`:572`) under `t_token` only
  (`:539`). Holds **no ifsq serializer**.

`struct ifqueue`/`ifaltq` operations are non-atomic TAILQ
manipulations. Concurrent enqueue on one CPU and dequeue on another
corrupts the queue: lost mbufs, one mbuf reachable from two queues, or
a `m_nextpkt` chain that later gets `m_freem`'d twice (double free into
the mbuf objcache → use-after-free on subsequent allocations), or a
dequeue that walks into a freed chain. `sloutput_serialized:505` also
calls `slstart` directly while holding the serializer — the reverse
order of every other caller — so even the same-CPU interleavings
cross the domains.

DF-0576..0579 covered the callout/t_typ lifetime races and the BPF
stack copy; this queue-domain violation was missed. MPSAFE tag at
`:2` notwithstanding, the fastq has no lock at all and the ifsq's
serializer is not held by the drain side.

## Impact

Requires SLIP configured (root: `SLIPDISC` line discipline needs
`SYSCAP_RESTRICTEDROOT`, `:251`) and then concurrent interactive-class
(IPTOS_LOWDELAY → fastq) TX traffic while the tty drains — e.g. a
multi-CPU box routing telnet-style traffic over slip. Mbuf queue
corruption is memory-safety class (double-free/UAF), realistically a
panic. LEGACY bucket. Low / likely. Phase V skipped (legacy, race,
needs serial-line driver + SMP contention — per batch instructions).

## Fix

Protect `sc->sc_fastq` with the tty token in `sloutput_serialized`
(acquire `sc->sc_ttyp->t_token` around the fastq enqueue) and make
`slstart`'s ifsq dequeue run under the serializer (or move both sides
to a single lock, e.g. always call `slstart` via the ifsq serializer
the way `sloutput:505` already does).