[Sorry, I can't use send-pr yet].

	I found the some place where the splx(s) may be missing, in
	the current source tree (of Jun 24).

1. In the file sys/dev/isa/bt742a.c, it returns from bt_scsi_cmd
   without calling splx(s) when bt_send_mbo returns NULL.

int 
bt_scsi_cmd(xs)
	struct scsi_xfer *xs;
{
	:

	s = splbio();

	if (bt_send_mbo(bt, BT_MBO_START, ccb) == NULL) {
		xs->error = XS_DRIVER_STUFFUP;
		bt_free_ccb(bt, ccb, flags);
		return TRY_AGAIN_LATER;
	}

2. In the file sys/dev/isa/aha1542.c, ditto.

3. In the file sys/miscfs/specfs/spec_vnops.c, in the funciton spec_fsync,
  if DIAGNOSTIC is defined, it jumps before s = splbio() without
  calling splx(s).

int
spec_fsync(ap)
	struct vop_fsync_args /* {
		:
{
		:
loop:
	s = splbio();
		:
#ifdef DIAGNOSTIC
		if (vp->v_dirtyblkhd.lh_first) {
			vprint("spec_fsync: dirty", vp);
			goto loop;
		}
#endif

enami.