This happened during boot when dhclient configured the fxp0 address. This is on our mostly-5.4 tree with local changes. This is with DEVICE_POLLING and SMP (we've removed the #error for this case, as -CURRENT). The same thing happens with em. I see netisr_poll() takes Giant and then the device's poll routine takes its lock, while the ioctl holds the device's lock and ether_poll_deregister() takes Giant. The if_fxp.c:2405 is the FXP_LOCK() in fxp_ioctl(). lock order reversal 1st 0xa23d9298 fxp0 (network driver) @ /d2/emaste/emaste_photon/usr/src/sys/dev/fxp/if_fxp.c:2405 2nd 0xa07b0ea0 Giant (Giant) @ /d2/emaste/emaste_photon/usr/src/sys/kern/kern_poll.c:466 KDB: stack backtrace: kdb_backtrace(0,ffffffff,a07d1910,a07d3148,a07846e0) at 0xa058f18e = kdb_backtrace+0x2e witness_checkorder(a07b0ea0,9,a073f539,1d2) at 0xa0598bb8 = witness_checkorder+0x548 _mtx_lock_flags(a07b0ea0,0,a073f539,1d2) at 0xa056ebd4 = _mtx_lock_flags+0x64 ether_poll_deregister(a23d9000,a23d9000,80206910,a2835a20,c5e15bd4) at 0xa055baa2 = ether_poll_deregister+0x22 fxp_stop(a23d9000,a23d9000,a23d9000,80206910,a2835a20) at 0xa04fd651 = fxp_stop+0x21 fxp_init_body(a23d9000) at 0xa04fd846 = fxp_init_body+0x36 fxp_ioctl(a23d9000,80206910,a2835a20) at 0xa04fe42d = fxp_ioctl+0xcd ifhwioctl(80206910,a23d9000,a2835a20,a280dd80,12b) at 0xa05e0082 = ifhwioctl+0x302 ifioctl(a2919d80,80206910,a2835a20,a280dd80,a056cf01) at 0xa05e08a1 = ifioctl+0xc1 soo_ioctl(a287c3b8,80206910,a2835a20,a2283780,a280dd80) at 0xa05a08df = soo_ioctl+0x3cf ioctl(a280dd80,c5e15d14,3,1,247) at 0xa059aefe = ioctl+0x35e syscall(2f,2f,2f,4,1) at 0xa06e0db7 = syscall+0x247 Xint0x80_syscall() at 0xa06cd9c9 = Xint0x80_syscall+0x29 --- syscall (54, FreeBSD ELF32, ioctl), eip = 0x680d2667, esp = 0x9fbfec8c, ebp = 0x9fbfecd8 --- -- Ed Maste, Sandvine Incorporated