Index: ./arch/xen/xen/xbdback_xenbus.c
===================================================================
RCS file: /cvsroot/src/sys/arch/xen/xen/xbdback_xenbus.c,v
retrieving revision 1.62
diff -u -p -r1.62 xbdback_xenbus.c
--- ./arch/xen/xen/xbdback_xenbus.c	6 Jan 2016 15:28:40 -0000	1.62
+++ ./arch/xen/xen/xbdback_xenbus.c	24 Dec 2016 11:52:13 -0000
@@ -1672,9 +1672,8 @@ xbdback_wakeup_thread(struct xbdback_ins
 	/* only set RUN state when we are WAITING for work */
 	if (xbdi->xbdi_status == WAITING)
 	       xbdi->xbdi_status = RUN;
-	mutex_exit(&xbdi->xbdi_lock);
-
 	cv_broadcast(&xbdi->xbdi_cv);
+	mutex_exit(&xbdi->xbdi_lock);
 }
 
 /*
Index: ./dev/iscsi/iscsi_send.c
===================================================================
RCS file: /cvsroot/src/sys/dev/iscsi/iscsi_send.c,v
retrieving revision 1.31
diff -u -p -r1.31 iscsi_send.c
--- ./dev/iscsi/iscsi_send.c	15 Jun 2016 04:30:30 -0000	1.31
+++ ./dev/iscsi/iscsi_send.c	24 Dec 2016 11:52:14 -0000
@@ -300,8 +300,8 @@ iscsi_send_thread(void *par)
 	/* so cleanup thread knows there's someone left */
 	iscsi_num_send_threads++;
 
+	mutex_enter(&conn->lock);
 	do {
-		mutex_enter(&conn->lock);
 		while (!conn->terminating) {
 			while (!conn->terminating &&
 				(pdu = TAILQ_FIRST(&conn->pdus_to_send)) != NULL) {
@@ -402,7 +402,6 @@ iscsi_send_thread(void *par)
 		mutex_enter(&conn->lock);
 		if (!conn->destroy)
 			cv_timedwait(&conn->idle_cv, &conn->lock, CONNECTION_IDLE_TIMEOUT);
-		mutex_exit(&conn->lock);
 		DEBC(conn, 1, ("Waited for conn_idle, destroy = %d\n", conn->destroy));
 
 	} while (!conn->destroy);
@@ -422,6 +421,7 @@ iscsi_send_thread(void *par)
 		TAILQ_REMOVE(&sess->conn_list, conn, connections);
 		sess->mru_connection = TAILQ_FIRST(&sess->conn_list);
 	}
+	mutex_exit(&conn->lock);
 
 	add_connection_cleanup(conn);
 
@@ -483,9 +483,9 @@ send_pdu(ccb_t *ccb, pdu_t *pdu, ccb_dis
 		TAILQ_INSERT_HEAD(&conn->pdus_to_send, pdu, send_chain);
 	else
 		TAILQ_INSERT_TAIL(&conn->pdus_to_send, pdu, send_chain);
-	mutex_exit(&conn->lock);
 
 	cv_broadcast(&conn->conn_cv);
+	mutex_exit(&conn->lock);
 
 	if (cdisp != CCBDISP_NOWAIT) {
 		ccb_timeout_start(ccb, COMMAND_TIMEOUT);
@@ -546,9 +546,9 @@ resend_pdu(ccb_t *ccb)
 		TAILQ_INSERT_TAIL(&conn->pdus_to_send, pdu, send_chain);
 	}
 	ccb_timeout_start(ccb, COMMAND_TIMEOUT);
-	mutex_exit(&conn->lock);
 
 	cv_broadcast(&conn->conn_cv);
+	mutex_exit(&conn->lock);
 }
 
 
Index: ./dev/iscsi/iscsi_utils.c
===================================================================
RCS file: /cvsroot/src/sys/dev/iscsi/iscsi_utils.c,v
retrieving revision 1.21
diff -u -p -r1.21 iscsi_utils.c
--- ./dev/iscsi/iscsi_utils.c	15 Jun 2016 04:30:30 -0000	1.21
+++ ./dev/iscsi/iscsi_utils.c	24 Dec 2016 11:52:14 -0000
@@ -288,9 +288,8 @@ free_ccb(ccb_t *ccb)
 
 	mutex_enter(&sess->lock);
 	TAILQ_INSERT_TAIL(&sess->ccb_pool, ccb, chain);
-	mutex_exit(&sess->lock);
-
 	cv_broadcast(&sess->ccb_cv);
+	mutex_exit(&sess->lock);
 }
 
 /*
@@ -381,26 +380,30 @@ wake_ccb(ccb_t *ccb, uint32_t status)
 	/* change the disposition so nobody tries this again */
 	ccb->disp = CCBDISP_BUSY;
 	ccb->status = status;
-	mutex_exit(&conn->lock);
 
 	switch (disp) {
 	case CCBDISP_FREE:
+		mutex_exit(&conn->lock);
 		free_ccb(ccb);
 		break;
 
 	case CCBDISP_WAIT:
+		mutex_exit(&conn->lock);
 		cv_broadcast(&conn->ccb_cv);
 		break;
 
 	case CCBDISP_SCSIPI:
+		mutex_exit(&conn->lock);
 		iscsi_done(ccb);
 		free_ccb(ccb);
 		break;
 
 	case CCBDISP_DEFER:
+		mutex_exit(&conn->lock);
 		break;
 
 	default:
+		mutex_exit(&conn->lock);
 		DEBC(conn, 1, ("CCB done, ccb = %p, invalid disposition %d", ccb, disp));
 		free_ccb(ccb);
 		break;
@@ -482,9 +485,8 @@ free_pdu(pdu_t *pdu)
 	mutex_enter(&conn->lock);
 	atomic_dec_uint(&conn->pducount);
 	TAILQ_INSERT_TAIL(&conn->pdu_pool, pdu, chain);
-	mutex_exit(&conn->lock);
-
 	cv_broadcast(&conn->pdu_cv);
+	mutex_exit(&conn->lock);
 }
 
 /*
Index: ./fs/puffs/puffs_msgif.c
===================================================================
RCS file: /cvsroot/src/sys/fs/puffs/puffs_msgif.c,v
retrieving revision 1.99
diff -u -p -r1.99 puffs_msgif.c
--- ./fs/puffs/puffs_msgif.c	7 Jul 2016 06:55:42 -0000	1.99
+++ ./fs/puffs/puffs_msgif.c	24 Dec 2016 11:52:16 -0000
@@ -429,9 +429,9 @@ puffs_msg_enqueue(struct puffs_mount *pm
 	park->park_flags |= PARKFLAG_ONQUEUE1;
 	pmp->pmp_msg_touser_count++;
 	park->park_refcount++;
-	mutex_exit(&pmp->pmp_lock);
 
 	cv_broadcast(&pmp->pmp_msg_waiter_cv);
+	mutex_exit(&pmp->pmp_lock);
 	putter_notify(pmp->pmp_pi);
 
 	DPRINTF(("touser: req %" PRIu64 ", preq: %p, park: %p, "