Index: sys/kern/kern_rmlock.c
===================================================================
--- sys/kern/kern_rmlock.c
+++ sys/kern/kern_rmlock.c
@@ -362,8 +362,11 @@
 	/* Remove our tracker from the per-cpu list. */
 	rm_tracker_remove(pc, tracker);
 
-	/* Check to see if the IPI granted us the lock after all. */
-	if (tracker->rmp_flags) {
+	/*
+	 * Check to see if the IPI granted us the lock after all.  The load of
+	 * rmp_flags must happen after the tracker is removed from the list.
+	 */
+	if (atomic_load_int(&tracker->rmp_flags) != 0) {
 		/* Just add back tracker - we hold the lock. */
 		rm_tracker_add(pc, tracker);
 		critical_exit();