--- a/sys/dev/netif/ae/if_ae.c
+++ b/sys/dev/netif/ae/if_ae.c
@@ -992,7 +992,20 @@
 	struct ifnet *ifp = &sc->arpcom.ac_if;
 	struct mii_data *mii = device_get_softc(sc->ae_miibus);
 
-	lwkt_serialize_enter(ifp->if_serializer);
+	/*
+	 * DF-3715 family (DF-3760/3935/3991/4218): ae_stop() tears this
+	 * callout down with the synchronous callout_stop() while holding
+	 * ifp->if_serializer; a callback dequeued and blocked in
+	 * lwkt_serialize_enter() then deadlocks the stopper (AB-BA,
+	 * wchan 'costp').  Use a try-enter and bail (the next tick
+	 * retries) so the callback can always complete and
+	 * callout_stop() can always return.
+	 */
+	if (!lwkt_serialize_try(ifp->if_serializer)) {
+		callout_reset(&sc->ae_tick_ch, 1, ae_tick, sc);
+		return;
+	}
+
 	mii_tick(mii);
 	callout_reset(&sc->ae_tick_ch, hz, ae_tick, sc);
 	lwkt_serialize_exit(ifp->if_serializer);