Reading through if_pppx.c I spotted a couple of places we need NET_LOCK(). ok?
Index: if_pppx.c =================================================================== RCS file: /cvs/src/sys/net/if_pppx.c,v retrieving revision 1.63 diff -u -p -u -p -r1.63 if_pppx.c --- if_pppx.c 12 Aug 2017 20:27:28 -0000 1.63 +++ if_pppx.c 27 Mar 2018 23:56:56 -0000 @@ -392,6 +392,8 @@ pppxwrite(dev_t dev, struct uio *uio, in proto = ntohl(*(uint32_t *)(th + 1)); m_adj(top, sizeof(uint32_t)); + NET_LOCK(); + switch (proto) { case AF_INET: ipv4_input(&pxi->pxi_if, top); @@ -403,9 +405,12 @@ pppxwrite(dev_t dev, struct uio *uio, in #endif default: m_freem(top); - return (EAFNOSUPPORT); + error = EAFNOSUPPORT; + break; } + NET_UNLOCK(); + return (error); } @@ -583,8 +588,10 @@ pppxclose(dev_t dev, int flags, int mode pxd = pppx_dev_lookup(dev); /* XXX */ + NET_LOCK(); while ((pxi = LIST_FIRST(&pxd->pxd_pxis))) pppx_if_destroy(pxd, pxi); + NET_UNLOCK(); LIST_REMOVE(pxd, pxd_entry);