It seems that the ethernet driver routines,
   when called from the interrupt routine, can munge the mbuf lists
   (since the various routines manipulating them only run at splimp()
   and therefore are unprotected).

Huh?  splimp() is supposed to block all of the things spltty(),
splnet(), splbio(), and splsoftclock() would block.

   I thought network
   things (like this) was supposed to run at splnet(), but evidently
   this is not the case.

In 4.4BSD, splnet() only blocked software interrupts, not hardware
interrupts.  Because of this, splimp() was used in network drivers.

Since splimp() also needs to include splbio() and spltty() (for ccd,
if_slip and if_ppp), running network drivers at splimp() is annoying,
as it increases the latency for some higher priority interrupts.  I
changed the existing splnet() to splsoftnet() (to be symmetric with
splsoftclock()), and made a new splnet() which blocks hardware
interrupts.  Thus, it is now the case that network drivers should run
at splnet().  Having them still run at splimp() should not be fatal,
though, since this is just a more strict locking than splnet().

It's possible that the pmax port was never properly updated for this,
or that someone screwed it up later.