Index: sys/xen/xen_intr.c
===================================================================
--- sys/xen/xen_intr.c
+++ sys/xen/xen_intr.c
@@ -702,6 +702,8 @@
 	int error;
 	struct evtchn_bind_ipi bind_ipi = { .vcpu = vcpu_id };
 
+	mtx_assert(&xen_intr_isrc_lock, MA_OWNED);
+
 	error = HYPERVISOR_event_channel_op(EVTCHNOP_bind_ipi,
 	                                    &bind_ipi);
 	if (error != 0)
@@ -722,6 +724,8 @@
 	struct evtchn_bind_virq bind_virq = { .virq = isrc->xi_virq,
 	                                      .vcpu = vcpu_id };
 
+	mtx_assert(&xen_intr_isrc_lock, MA_OWNED);
+
 	error = HYPERVISOR_event_channel_op(EVTCHNOP_bind_virq,
 	                                    &bind_virq);
 	if (error != 0)
@@ -736,6 +740,8 @@
 	int cpu = isrc->xi_cpu;
 	int error;
 
+	mtx_assert(&xen_intr_isrc_lock, MA_OWNED);
+
 	switch (isrc->xi_type) {
 	case EVTCHN_TYPE_IPI:
 		xen_rebind_ipi(isrc);
@@ -782,6 +788,9 @@
 	for (i = 0; i < nitems(s->evtchn_mask); i++)
 		atomic_store_rel_long(&s->evtchn_mask[i], ~0);
 
+	/* Protect xen_intr_port_to_isrc[] / ->xi_port */
+	mtx_lock(&xen_intr_isrc_lock);
+
 	/* Clear existing port mappings */
 	for (isrc_idx = 0; isrc_idx < NR_EVENT_CHANNELS; ++isrc_idx)
 		if (xen_intr_port_to_isrc[isrc_idx] != NULL)
@@ -818,6 +827,9 @@
 			cur = next;
 		} while (cur != NULL);
 	}
+
+	/* Done with xen_intr_port_to_isrc[] / ->xi_port */
+	mtx_unlock(&xen_intr_isrc_lock);
 }
 
 /**