Index: sys/netgraph/ng_l2tp.c
===================================================================
--- sys/netgraph/ng_l2tp.c
+++ sys/netgraph/ng_l2tp.c
@@ -656,9 +656,9 @@
 	/* Reset sequence number state */
 	ng_l2tp_seq_reset(priv);
 
-	/* Free private data if neither timer is running */
-	ng_uncallout(&seq->rack_timer, node);
-	ng_uncallout(&seq->xack_timer, node);
+	/* Wait for callouts to finish executing before freeing anything. */
+	callout_drain(&seq->rack_timer);
+	callout_drain(&seq->xack_timer);
 
 	mtx_destroy(&seq->mtx);
 
@@ -1274,6 +1274,8 @@
 	/* Sanity check */
 	L2TP_SEQ_CHECK(seq);
 
+	mtx_lock(&seq->mtx);
+
 	/* Stop timers */
 	ng_uncallout(&seq->rack_timer, priv->node);
 	ng_uncallout(&seq->xack_timer, priv->node);
@@ -1300,6 +1302,8 @@
 	seq->rexmits = 0;
 	bzero(seq->xwin, sizeof(seq->xwin));
 
+	mtx_unlock(&seq->mtx);
+
 	/* Done */
 	L2TP_SEQ_CHECK(seq);
 }