so_state modifications must be synchronized by the socket lock. For the
listening socket this probably doesn't matter but for the child socket I
think it's possible that this unlocked update clobbers a state
transition if the nascent connection is being disconnected for some
reason.
Untested, I just spotted this while reading code, staring at PR 292884.