Index: sys/dev/iscsi/iscsi_ioctl.c
===================================================================
RCS file: /cvsroot/src/sys/dev/iscsi/iscsi_ioctl.c,v
retrieving revision 1.37
diff -p -u -r1.37 iscsi_ioctl.c
--- sys/dev/iscsi/iscsi_ioctl.c	3 Nov 2024 10:53:02 -0000	1.37
+++ sys/dev/iscsi/iscsi_ioctl.c	13 Nov 2024 07:08:19 -0000
@@ -490,6 +494,7 @@ kill_connection(connection_t *conn, uint
 			   "state=%d\n",
 			   conn->c_terminating, status, logout, conn->c_state));
 
+	mutex_enter(&conn->c_lock);
 	mutex_enter(&iscsi_cleanup_mtx);
 	if (recover &&
 	    !conn->c_destroy &&
@@ -513,11 +518,9 @@ kill_connection(connection_t *conn, uint
 		}
 	}
 
-	mutex_enter(&conn->c_lock);
 	terminating = conn->c_terminating;
 	if (!terminating)
 		conn->c_terminating = status;
-	mutex_exit(&conn->c_lock);
 
 	/* Don't recurse */
 	if (terminating) {
@@ -549,11 +552,10 @@ kill_connection(connection_t *conn, uint
 			}
 
 			/* connection is terminating, prevent cleanup */
-			mutex_enter(&conn->c_lock);
 			conn->c_usecount++;
-			mutex_exit(&conn->c_lock);
 
 			mutex_exit(&iscsi_cleanup_mtx);
+			mutex_exit(&conn->c_lock);
 
 			DEBC(conn, 1, ("Send_logout for reason %d\n", logout));
 
@@ -574,12 +576,11 @@ kill_connection(connection_t *conn, uint
 			 * once the timeout hits.
 			 */
 
+			mutex_enter(&conn->c_lock);
 			mutex_enter(&iscsi_cleanup_mtx);
 
 			/* release connection */
-			mutex_enter(&conn->c_lock);
 			conn->c_usecount--;
-			mutex_exit(&conn->c_lock);
 		}
 
 	}
@@ -589,7 +590,6 @@ kill_connection(connection_t *conn, uint
 
 done:
 	/* let send thread take over next step of cleanup */
-	mutex_enter(&conn->c_lock);
 	cv_broadcast(&conn->c_conn_cv);
 	mutex_exit(&conn->c_lock);
 
Index: sys/dev/iscsi/iscsi_send.c
===================================================================
RCS file: /cvsroot/src/sys/dev/iscsi/iscsi_send.c,v
retrieving revision 1.41
diff -p -u -r1.41 iscsi_send.c
--- sys/dev/iscsi/iscsi_send.c	24 Aug 2024 09:39:44 -0000	1.41
+++ sys/dev/iscsi/iscsi_send.c	13 Nov 2024 07:08:19 -0000
@@ -343,6 +343,9 @@ iscsi_send_thread(void *par)
 				(pdu = TAILQ_FIRST(&conn->c_pdus_to_send)) != NULL) {
 				TAILQ_REMOVE(&conn->c_pdus_to_send, pdu, pdu_send_chain);
 				pdu->pdu_flags &= ~PDUF_INQUEUE;
+				pdisp = pdu->pdu_disp;
+				if (pdisp > PDUDISP_FREE)
+					pdu->pdu_flags &= ~PDUF_BUSY;
 				mutex_exit(&conn->c_lock);
 
 				/* update ExpStatSN here to avoid discontinuities */
@@ -357,11 +360,6 @@ iscsi_send_thread(void *par)
 				                ntohl(pdu->pdu_hdr.pduh_p.command.ExpStatSN)));
 				my_soo_write(conn, &pdu->pdu_uio);
 
-				mutex_enter(&conn->c_lock);
-				pdisp = pdu->pdu_disp;
-				if (pdisp > PDUDISP_FREE)
-					pdu->pdu_flags &= ~PDUF_BUSY;
-				mutex_exit(&conn->c_lock);
 				if (pdisp <= PDUDISP_FREE)
 					free_pdu(pdu);
 
@@ -527,9 +525,7 @@ send_pdu(ccb_t *ccb, pdu_t *pdu, ccb_dis
 		if (prev_cdisp <= CCBDISP_NOWAIT)
 			suspend_ccb(ccb, TRUE);
 
-		mutex_exit(&conn->c_lock);
 		ccb_timeout_start(ccb, COMMAND_TIMEOUT);
-		mutex_enter(&conn->c_lock);
 
 		while (ccb->ccb_disp == CCBDISP_WAIT) {
 			DEBC(conn, 15, ("Send_pdu: ccb=%p cdisp=%d waiting\n",
Index: sys/dev/iscsi/iscsi_utils.c
===================================================================
RCS file: /cvsroot/src/sys/dev/iscsi/iscsi_utils.c,v
retrieving revision 1.29
diff -p -u -r1.29 iscsi_utils.c
--- sys/dev/iscsi/iscsi_utils.c	25 Nov 2023 10:08:27 -0000	1.29
+++ sys/dev/iscsi/iscsi_utils.c	13 Nov 2024 07:08:19 -0000
@@ -259,6 +262,7 @@ free_ccb(ccb_t *ccb)
 	session_t *sess = ccb->ccb_session;
 	connection_t *conn = ccb->ccb_connection;
 	pdu_t *pdu;
+	pdu_disp_t pdisp;
 
 	DEBC(conn, 15, (
 		"free_ccb: ccb = %p, usecount = %d\n",
@@ -288,12 +292,14 @@ free_ccb(ccb_t *ccb)
 	if ((pdu = ccb->ccb_pdu_waiting) != NULL) {
 		ccb->ccb_pdu_waiting = NULL;
 		mutex_enter(&conn->c_lock);
+		pdisp = pdu->pdu_disp;
 		if ((pdu->pdu_flags & PDUF_INQUEUE) != 0) {
 			TAILQ_REMOVE(&conn->c_pdus_to_send, pdu, pdu_send_chain);
 			pdu->pdu_flags &= ~PDUF_INQUEUE;
 		}
 		mutex_exit(&conn->c_lock);
-		free_pdu(pdu);
+		if (pdisp > PDUDISP_FREE)
+			free_pdu(pdu);
 	}
 
 	mutex_enter(&sess->s_lock);