--- a/sys/dev/raid/tws/tws_cam.c
+++ b/sys/dev/raid/tws/tws_cam.c
@@ -589,11 +589,13 @@
     ccb->csio.scsi_status = req->cmd_pkt->cmd.pkt_a.status;
 
     ccb->ccb_h.status &= ~CAM_SIM_QUEUED;
+    /* stop the timeout while the ccb is still ours: after xpt_done() CAM
+     * owns it and may recycle/free it (see tws_scsi_complete) */
+    callout_stop(req->ccb_ptr->ccb_h.timeout_ch);
     lockmgr(&sc->sim_lock, LK_EXCLUSIVE);
     xpt_done(ccb);
     lockmgr(&sc->sim_lock, LK_RELEASE);
 
-    callout_stop(req->ccb_ptr->ccb_h.timeout_ch);
     tws_unmap_request(req->sc, req);
     lockmgr(&sc->q_lock, LK_EXCLUSIVE);
     tws_q_remove_request(sc, req, TWS_BUSY_Q);