diff --git a/sys/netinet/ip_input.c b/sys/netinet/ip_input.c
index 84b89b9f915a..4f5d7ebb9372 100644
--- a/sys/netinet/ip_input.c
+++ b/sys/netinet/ip_input.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: ip_input.c,v 1.272 2008/05/05 17:11:17 ad Exp $	*/
+/*	$NetBSD: ip_input.c,v 1.273 2008/08/20 18:35:20 matt Exp $	*/
 
 /*
  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
@@ -91,7 +91,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: ip_input.c,v 1.272 2008/05/05 17:11:17 ad Exp $");
+__KERNEL_RCSID(0, "$NetBSD: ip_input.c,v 1.273 2008/08/20 18:35:20 matt Exp $");
 
 #include "opt_inet.h"
 #include "opt_gateway.h"
@@ -2143,9 +2143,13 @@ sysctl_net_inet_ip_pmtudto(SYSCTLFN_ARGS)
 	if (tmp < 0)
 		return (EINVAL);
 
+	mutex_enter(softnet_lock);
+
 	ip_mtudisc_timeout = tmp;
 	rt_timer_queue_change(ip_mtudisc_timeout_q, ip_mtudisc_timeout);
 
+	mutex_exit(softnet_lock);
+
 	return (0);
 }
 
@@ -2156,15 +2160,19 @@ sysctl_net_inet_ip_pmtudto(SYSCTLFN_ARGS)
 static int
 sysctl_net_inet_ip_maxflows(SYSCTLFN_ARGS)
 {
-	int s;
+	int error;
 
-	s = sysctl_lookup(SYSCTLFN_CALL(rnode));
-	if (s || newp == NULL)
-		return (s);
+	error = sysctl_lookup(SYSCTLFN_CALL(rnode));
+	if (error || newp == NULL)
+		return (error);
+
+	mutex_enter(softnet_lock);
+	KERNEL_LOCK(1, NULL);
 
-	s = splsoftnet();
 	ipflow_prune();
-	splx(s);
+
+	KERNEL_UNLOCK_ONE(NULL);
+	mutex_exit(softnet_lock);
 
 	return (0);
 }
@@ -2186,16 +2194,22 @@ sysctl_net_inet_ip_hashsize(SYSCTLFN_ARGS)
 		/*
 		 * Can only fail due to malloc()
 		 */
-		if (ipflow_invalidate_all(tmp))
-			return ENOMEM;
+		mutex_enter(softnet_lock);
+		KERNEL_LOCK(1, NULL);
+
+		error = ipflow_invalidate_all(tmp);
+
+		KERNEL_UNLOCK_ONE(NULL);
+		mutex_exit(softnet_lock);
+
 	} else {
 		/*
 		 * EINVAL if not a power of 2
 	         */
-		return EINVAL;
+		error = EINVAL;
 	}	
 
-	return (0);
+	return error;
 }
 #endif /* GATEWAY */
 
diff --git a/sys/netinet/tcp_usrreq.c b/sys/netinet/tcp_usrreq.c
index a3df6db6ea48..e2bb6df04347 100644
--- a/sys/netinet/tcp_usrreq.c
+++ b/sys/netinet/tcp_usrreq.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: tcp_usrreq.c,v 1.147 2008/08/06 15:01:23 plunky Exp $	*/
+/*	$NetBSD: tcp_usrreq.c,v 1.148 2008/08/20 18:35:20 matt Exp $	*/
 
 /*
  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
@@ -95,7 +95,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: tcp_usrreq.c,v 1.147 2008/08/06 15:01:23 plunky Exp $");
+__KERNEL_RCSID(0, "$NetBSD: tcp_usrreq.c,v 1.148 2008/08/20 18:35:20 matt Exp $");
 
 #include "opt_inet.h"
 #include "opt_ipsec.h"
@@ -1272,7 +1272,7 @@ sysctl_net_inet_tcp_ident(SYSCTLFN_ARGS)
 	struct sockaddr_in6 *si6[2];
 #endif /* INET6 */
 	struct sockaddr_storage sa[2];
-	int error, pf, dodrop, s;
+	int error, pf, dodrop;
 
 	dodrop = name[-1] == TCPCTL_DROP;
 	if (dodrop) {
@@ -1302,10 +1302,10 @@ sysctl_net_inet_tcp_ident(SYSCTLFN_ARGS)
 		laddr.s_addr = (uint32_t)name[2];
 		lport = (u_int)name[3];
 		
-		s = splsoftnet();
+		mutex_enter(softnet_lock);
 		error = inet4_ident_core(raddr, rport, laddr, lport,
 		    oldp, oldlenp, l, dodrop);
-		splx(s);
+		mutex_exit(softnet_lock);
 		return error;
 #else /* INET */
 		return EINVAL;
@@ -1342,11 +1342,11 @@ sysctl_net_inet_tcp_ident(SYSCTLFN_ARGS)
 			if (error)
 				return error;
 
-			s = splsoftnet();
+			mutex_enter(softnet_lock);
 			error = inet6_ident_core(&si6[0]->sin6_addr,
 			    si6[0]->sin6_port, &si6[1]->sin6_addr,
 			    si6[1]->sin6_port, oldp, oldlenp, l, dodrop);
-			splx(s);
+			mutex_exit(softnet_lock);
 			return error;
 		}
 
@@ -1366,11 +1366,11 @@ sysctl_net_inet_tcp_ident(SYSCTLFN_ARGS)
 		    si4[0]->sin_len != sizeof(*si4[1]))
 			return EINVAL;
 	
-		s = splsoftnet();
+		mutex_enter(softnet_lock);
 		error = inet4_ident_core(si4[0]->sin_addr, si4[0]->sin_port,
 		    si4[1]->sin_addr, si4[1]->sin_port,
 		    oldp, oldlenp, l, dodrop);
-		splx(s);
+		mutex_exit(softnet_lock);
 		return error;
 #endif /* INET */
 	default:
@@ -1439,6 +1439,8 @@ sysctl_inpcblist(SYSCTLFN_ARGS)
 	proto = oname[2];
 	pf2 = (oldp != NULL) ? pf : 0;
 
+	mutex_enter(softnet_lock);
+
 	CIRCLEQ_FOREACH(inph, &pcbtbl->inpt_queue, inph_queue) {
 #ifdef INET
 		inp = (const struct inpcb *)inph;
@@ -1566,6 +1568,8 @@ sysctl_inpcblist(SYSCTLFN_ARGS)
 	if (oldp == NULL)
 		*oldlenp += PCB_SLOP * sizeof(struct kinfo_pcb);
 
+	mutex_exit(softnet_lock);
+
 	return (error);
 }
 
@@ -1573,7 +1577,7 @@ static int
 sysctl_tcp_congctl(SYSCTLFN_ARGS)
 {
 	struct sysctlnode node;
-	int error, r;
+	int error;
 	char newname[TCPCC_MAXLEN];
 
 	strlcpy(newname, tcp_congctl_global_name, sizeof(newname) - 1);
@@ -1589,9 +1593,10 @@ sysctl_tcp_congctl(SYSCTLFN_ARGS)
 	    strncmp(newname, tcp_congctl_global_name, sizeof(newname)) == 0)
 		return error;
 
-	if ((r = tcp_congctl_select(NULL, newname)))
-		return r;
-	
+	mutex_enter(softnet_lock);
+	error = tcp_congctl_select(NULL, newname);
+	mutex_exit(softnet_lock);
+
 	return error;
 }
 
@@ -1610,8 +1615,12 @@ sysctl_tcp_keep(SYSCTLFN_ARGS)
 	if (error || newp == NULL)
 		return error;
 
+	mutex_enter(softnet_lock);
+
 	*(u_int *)rnode->sysctl_data = tmp;
 	tcp_tcpcb_template();	/* update the template */
+
+	mutex_exit(softnet_lock);
 	return 0;
 }
 
diff --git a/sys/netinet6/in6_pcb.c b/sys/netinet6/in6_pcb.c
index 8210d1507985..658584b1f694 100644
--- a/sys/netinet6/in6_pcb.c
+++ b/sys/netinet6/in6_pcb.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: in6_pcb.c,v 1.98 2008/08/04 06:47:52 matt Exp $	*/
+/*	$NetBSD: in6_pcb.c,v 1.99 2008/08/20 18:35:20 matt Exp $	*/
 /*	$KAME: in6_pcb.c,v 1.84 2001/02/08 18:02:08 itojun Exp $	*/
 
 /*
@@ -62,7 +62,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: in6_pcb.c,v 1.98 2008/08/04 06:47:52 matt Exp $");
+__KERNEL_RCSID(0, "$NetBSD: in6_pcb.c,v 1.99 2008/08/20 18:35:20 matt Exp $");
 
 #include "opt_inet.h"
 #include "opt_ipsec.h"
@@ -107,7 +107,7 @@ __KERNEL_RCSID(0, "$NetBSD: in6_pcb.c,v 1.98 2008/08/04 06:47:52 matt Exp $");
 #include <netipsec/key.h>
 #endif /* FAST_IPSEC */
 
-struct in6_addr zeroin6_addr;
+const struct in6_addr zeroin6_addr;
 
 #define	IN6PCBHASH_PORT(table, lport) \
 	&(table)->inpt_porthashtbl[ntohs(lport) & (table)->inpt_porthash]
diff --git a/sys/netinet6/in6_var.h b/sys/netinet6/in6_var.h
index dddbe9127460..bb937c877766 100644
--- a/sys/netinet6/in6_var.h
+++ b/sys/netinet6/in6_var.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: in6_var.h,v 1.59 2008/07/31 18:24:07 matt Exp $	*/
+/*	$NetBSD: in6_var.h,v 1.60 2008/08/20 18:35:20 matt Exp $	*/
 /*	$KAME: in6_var.h,v 1.81 2002/06/08 11:16:51 itojun Exp $	*/
 
 /*
@@ -480,8 +480,8 @@ do {								\
 } while (/*CONSTCOND*/ 0)
 
 extern struct ifqueue ip6intrq;		/* IP6 packet input queue */
-extern struct in6_addr zeroin6_addr;
-extern u_char inet6ctlerrmap[];
+extern const struct in6_addr zeroin6_addr;
+extern const u_char inet6ctlerrmap[];
 extern unsigned long in6_maxmtu;
 
 /*
diff --git a/sys/netinet6/ip6_input.c b/sys/netinet6/ip6_input.c
index 526a56a83d0f..9143c05b45f1 100644
--- a/sys/netinet6/ip6_input.c
+++ b/sys/netinet6/ip6_input.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: ip6_input.c,v 1.119 2008/05/04 07:22:15 thorpej Exp $	*/
+/*	$NetBSD: ip6_input.c,v 1.120 2008/08/20 18:35:20 matt Exp $	*/
 /*	$KAME: ip6_input.c,v 1.188 2001/03/29 05:34:31 itojun Exp $	*/
 
 /*
@@ -62,7 +62,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: ip6_input.c,v 1.119 2008/05/04 07:22:15 thorpej Exp $");
+__KERNEL_RCSID(0, "$NetBSD: ip6_input.c,v 1.120 2008/08/20 18:35:20 matt Exp $");
 
 #include "opt_inet.h"
 #include "opt_inet6.h"
@@ -1595,15 +1595,19 @@ ip6_delaux(struct mbuf *m)
 static int
 sysctl_net_inet6_ip6_maxflows(SYSCTLFN_ARGS)
 {  
-        int s;
+        int error;
   
-        s = sysctl_lookup(SYSCTLFN_CALL(rnode));
-        if (s || newp == NULL)
-                return (s);
+        error = sysctl_lookup(SYSCTLFN_CALL(rnode));
+        if (error || newp == NULL)
+                return (error);
  
-        s = splsoftnet();
+        mutex_enter(softnet_lock);
+	KERNEL_LOCK_ONE(1, NULL);
+
         ip6flow_reap(0);
-        splx(s);
+
+	KERNEL_UNLOCK_ONE(NULL);
+        mutex_exit(softnet_lock);
  
         return (0);
 }
@@ -1625,16 +1629,21 @@ sysctl_net_inet6_ip6_hashsize(SYSCTLFN_ARGS)
 		/*
 		 * Can only fail due to malloc()
 		 */
-		if (ip6flow_invalidate_all(tmp))
-			return ENOMEM;
+		mutex_enter(softnet_lock);
+		KERNEL_LOCK_ONE(1, NULL);
+
+		error = ip6flow_invalidate_all(tmp);
+
+		KERNEL_UNLOCK_ONE(NULL);
+		mutex_exit(softnet_lock);
 	} else {
 		/*
 		 * EINVAL if not a power of 2
 	         */
-		return EINVAL;
+		error = EINVAL;
 	}	
 
-	return (0);
+	return error;
 }
 #endif /* GATEWAY */
 
@@ -1642,7 +1651,7 @@ sysctl_net_inet6_ip6_hashsize(SYSCTLFN_ARGS)
  * System control for IP6
  */
 
-u_char	inet6ctlerrmap[PRC_NCMDS] = {
+const u_char inet6ctlerrmap[PRC_NCMDS] = {
 	0,		0,		0,		0,
 	0,		EMSGSIZE,	EHOSTDOWN,	EHOSTUNREACH,
 	EHOSTUNREACH,	EHOSTUNREACH,	ECONNREFUSED,	ECONNREFUSED,