# DF-3403 — if_sl: slstart dereferences tp->t_slsc (and the softc) before taking any token

## What

`sys/net/sl/if_sl.c:529-532`:

```c
slstart(struct tty *tp)
{
        struct sl_softc *sc = (struct sl_softc *)tp->t_slsc;
        struct ifaltq_subque *ifsq = ifq_get_subq_default(&sc->sc_if.if_snd);
        ...
        lwkt_gettoken(&tp->t_token);        /* :539 — too late */
```

`tp->t_slsc` is read and `sc` is dereferenced **before** `t_token` (or
`tty_token`) is acquired. `slclose` (`:302-338`) nulls `tp->t_slsc`
(`:326`) and `sc->sc_ttyp` (`:325`) under `tty_token`+`t_token`, and
`sltioctl`'s SLIOCSUNIT swaps softc contents under the same tokens
(`:359-392`). A `slstart` invocation racing the close on another CPU
reads `t_slsc == NULL` (NULL deref at `&sc->sc_if.if_snd` → immediate
panic) or a softc mid-swap (garbage ifq pointer → wild deref).

Downstream, `:546` `(*tp->t_oproc)(tp)` and the `sc == NULL` check at
`:560` (after the token) partially paper over this, but the `:531-532`
prologue is outside any protection. Distinct from DF-0576, which
covers the *callout handlers* (`sl_keepalive:1016`,
`sl_outfill:1043`) reading `sc->sc_ttyp` before the token — this is
the main TX entry reading `t_slsc`/softc before the token.

## Impact

Root must have configured SLIP; the race window is the close/detach of
the tty versus a driver-driven `l_start` call. PANIC (NULL/wild
dereference) on SMP. Low / likely. LEGACY bucket. Phase V skipped
(legacy race, per batch instructions).

## Fix

Move the `sc`/`ifsq` derivation below `lwkt_gettoken(&tp->t_token)`
and bail out if `sc == NULL` before touching `sc->sc_if`.