Index: sys/kern/kern_fail.c
===================================================================
--- sys/kern/kern_fail.c
+++ sys/kern/kern_fail.c
@@ -403,6 +403,7 @@
 		wakeup(FP_PAUSE_CHANNEL(fp));
 		tsleep(&fp, PWAIT, "fail_point_drain", hz / 100);
 	}
+	callout_drain(&fp->fp_callout);
 	fail_point_swap_settings(fp, entries);
 }
 
@@ -442,8 +443,8 @@
 			if (fp->fp_pre_sleep_fn)
 				fp->fp_pre_sleep_fn(fp->fp_pre_sleep_arg);
 
-			timeout(fp->fp_post_sleep_fn, fp->fp_post_sleep_arg,
-			    timo);
+			callout_reset(&fp->fp_callout, timo,
+			    fp->fp_post_sleep_fn, fp->fp_post_sleep_arg);
 			*pret = FAIL_POINT_RC_QUEUED;
 		}
 	}
@@ -491,6 +492,7 @@
 	fp->fp_pre_sleep_arg = NULL;
 	fp->fp_post_sleep_fn = NULL;
 	fp->fp_post_sleep_arg = NULL;
+	callout_init(&fp->fp_callout, CALLOUT_MPSAFE);
 }
 
 /**
Index: sys/sys/fail.h
===================================================================
--- sys/sys/fail.h
+++ sys/sys/fail.h
@@ -84,6 +84,8 @@
 	void (*fp_post_sleep_fn)(void *);
 	/**< Arg for fp_post_sleep_fn */
 	void *fp_post_sleep_arg;
+
+	struct callout fp_callout;
 };
 
 #define	FAIL_POINT_DYNAMIC_NAME	0x01	/**< Must free name on destroy */