The variable nfs_reqq was protected by splsoftnet() only in 3 out of 5 cases.  In the functions nfs_reconnect() and nfs_reply() put the TAILQ_FOREACH over nfs_reqq also inside splsoftnet() protection.
The variable nfs_reqq was protected by splsoftnet() only in 3 out
of 5 cases.  In the functions nfs_reconnect() and nfs_reply() put
the TAILQ_FOREACH over nfs_reqq also inside splsoftnet() protection.

found with pedro@,  ok blambert@, pedro@, thib@

orumin/openbsd-efivars,orumin/openbsd-efivars,orumin/openbsd-efivars,orumin/openbsd-efivars