--- a/sys/dev/netif/sk/if_sk.c 2026-09-16 22:58:01.968006718 +0000 +++ b2/sys/dev/netif/sk/if_sk.c 2026-09-16 22:58:32.507613498 +0000 @@ -2038,7 +2038,16 @@ DPRINTFN(2, ("sk_tick\n")); - lwkt_serialize_enter(ifp->if_serializer); + if (!lwkt_serialize_try(ifp->if_serializer)) { + /* + * Never park the softclock thread on the serializer: + * sk_stop() tears this callout down with the synchronous + * callout_stop() while holding the same serializer + * (if_sk.c:2782) -> AB-BA deadlock. Retry next tick. + */ + callout_reset(&sc_if->sk_tick_timer, 1, sk_tick, sc_if); + return; + } if ((ifp->if_flags & IFF_UP) == 0) { lwkt_serialize_exit(ifp->if_serializer); @@ -2084,7 +2093,16 @@ struct ifnet *ifp = &sc_if->arpcom.ac_if; struct mii_data *mii = device_get_softc(sc_if->sk_miibus); - lwkt_serialize_enter(ifp->if_serializer); + if (!lwkt_serialize_try(ifp->if_serializer)) { + /* + * sk_stop() calls callout_stop(&sc_if->sk_tick_timer) + * under this serializer (if_sk.c:2782) and callout_stop() + * waits for an in-progress callback: blocking here + * deadlocks the callout subsystem (AB-BA). + */ + callout_reset(&sc_if->sk_tick_timer, 1, sk_yukon_tick, sc_if); + return; + } mii_tick(mii); callout_reset(&sc_if->sk_tick_timer, hz, sk_yukon_tick, sc_if); lwkt_serialize_exit(ifp->if_serializer);