It would seem simpler to reuse the existing VNET_LIST lock. I would also probably restructure this like so:

    VNET_LIST_RLOCK();
    while (pf_end_threads == 0) {
        VNET_LIST_SLEEP(pf_purge_thread, ....);
        /* existing code, but don't need pf_end_threads check or RUNLOCK(). */
    }
    VNET_LIST_RUNLOCK();
    kproc_exit(0);
}

This does require adding a VNET_LIST_SLEEP() macro to vnet.h, but that seems cleaner than doing an explicit sx_sleep() on &vnet_sxlock given the VNET_LIST_RLOCK/RUNLOCK macros.

You need to add a 'static struct proc *pf_purge_proc;' global to this file and change this line to:

error = kproc_create(pf_purge_thread, NULL, &pf_purge_proc, 0, 0, "pf purge");

Here you would use VNET_LIST_WLOCK() and sleep on the proc address:

VNET_LIST_WLOCK();
pf_end_threads = 1;
wakeup(pf_purge_thread);
VNET_LIST_SLEEP(pf_purge_proc, 0, "pftmo", 0);
VNET_LIST_WUNLOCK();

In particular, sleeping on pf_end_threads is still subject to a race that can lead to a panic. Namely, pf_purge_thread() might be preempted after it has incremented pf_end_threads but before it has finished exiting from the function. Then pf_unload() might resume and complete and the pf.ko module would be removed from the kernel (including freeing its memory, etc.). When the pf purge thread resumed at the tail end of pf_purge_thread() it would then panic because it would be trying to execute instructions at an invalid virtual address. This is why you have to sleep on the process or thread structure as that is only awoken from within kproc_exit or kthread_exit at which point you know that the associated kthread is no longer executing instructions in a module.