I think you're missing some splx(s) below.

Are you sure in[6]_pcbpurgeif0(), in[6]_purgeif()
and in[6]_pcbpurgeif() need splsoftnet()?  This
seems to be outside the pool issue.

Regards,

-seanb

> Index: netinet/raw_ip.c
> ===================================================================
> RCS file: /cvsroot/src/sys/netinet/raw_ip.c,v
> retrieving revision 1.86
> diff -u -r1.86 raw_ip.c
> --- netinet/raw_ip.c	11 Mar 2005 06:16:16 -0000	1.86
> +++ netinet/raw_ip.c	19 Jul 2006 21:22:38 -0000
> @@ -514,6 +514,8 @@
>  		return (in_control(so, (long)m, (caddr_t)nam,
>  		    (struct ifnet *)control, p));
>  
> +	s = splsoftnet();
> +
>  	if (req == PRU_PURGEIF) {
>  		in_pcbpurgeif0(&rawcbtable, (struct ifnet *)control);
>  		in_purgeif((struct ifnet *)control);
> @@ -521,7 +523,6 @@
		splx(x);
>  		return (0);
>  	}
>  
> -	s = splsoftnet();
>  	inp = sotoinpcb(so);
>  #ifdef DIAGNOSTIC
>  	if (req != PRU_SEND && req != PRU_SENDOOB && control)



> Index: netinet/tcp_usrreq.c
> ===================================================================
> RCS file: /cvsroot/src/sys/netinet/tcp_usrreq.c,v
> retrieving revision 1.100.2.2
> diff -u -r1.100.2.2 tcp_usrreq.c
> --- netinet/tcp_usrreq.c	6 May 2005 08:35:27 -0000	1.100.2.2
> +++ netinet/tcp_usrreq.c	19 Jul 2006 21:22:38 -0000
> @@ -199,6 +199,8 @@
>  		}
>  	}
>  
> +	s = splsoftnet();
> +
>  	if (req == PRU_PURGEIF) {
>  		switch (family) {
>  #ifdef INET
> @@ -221,7 +223,6 @@
		default:
			splx(x);
			return (EAFNOSUPPORT);
		}
		splx(x);
>  		return (0);
>  	}
>  
> -	s = splsoftnet();
>  	switch (family) {
>  #ifdef INET
>  	case PF_INET: