We currently call arc4random() unconditionally to initialize sc_iss, but then when syncookies are enabled, we overwrite it with the return value from from syncookie_generate(). It would seem to make more sense to only call arc4random() when syncookies are not enabled.
Note that on a system under a syn flood attack, arc4random() becomes quite expensive, and the chacha_poly crypto that it calls is one of the more expensive things happening on the system. Removing this unneeded arc4random() call reduces CPU from about 40% to about 35% in my test scenario (Broadwell Xeon, 6Mpps syn flood attack).