splnet() was necessary when link state changes were executed from hardware interrupt handlers. In 2013 they got deferred to their own task, so KERNEL_LOCK() is what really protect these data structures.
This is part of my bigger socket lock diff. ok? Index: kern/uipc_socket.c =================================================================== RCS file: /cvs/src/sys/kern/uipc_socket.c,v retrieving revision 1.163 diff -u -p -r1.163 uipc_socket.c --- kern/uipc_socket.c 6 Oct 2016 19:09:08 -0000 1.163 +++ kern/uipc_socket.c 7 Nov 2016 08:52:42 -0000 @@ -1037,12 +1037,10 @@ sorflush(struct socket *so) { struct sockbuf *sb = &so->so_rcv; struct protosw *pr = so->so_proto; - int s; struct sockbuf asb; sb->sb_flags |= SB_NOINTR; (void) sblock(sb, M_WAITOK); - s = splnet(); socantrcvmore(so); sbunlock(sb); asb = *sb; @@ -1052,7 +1050,6 @@ sorflush(struct socket *so) sb->sb_sel.si_note = asb.sb_sel.si_note; sb->sb_flags = SB_KNOTE; } - splx(s); if (pr->pr_flags & PR_RIGHTS && pr->pr_domain->dom_dispose) (*pr->pr_domain->dom_dispose)(asb.sb_mb); sbrelease(&asb); @@ -1876,7 +1873,8 @@ soo_kqfilter(struct file *fp, struct kno { struct socket *so = kn->kn_fp->f_data; struct sockbuf *sb; - int s; + + KERNEL_ASSERT_LOCKED(); switch (kn->kn_filter) { case EVFILT_READ: @@ -1894,10 +1892,9 @@ soo_kqfilter(struct file *fp, struct kno return (EINVAL); } - s = splnet(); SLIST_INSERT_HEAD(&sb->sb_sel.si_note, kn, kn_selnext); sb->sb_flags |= SB_KNOTE; - splx(s); + return (0); } @@ -1905,12 +1902,12 @@ void filt_sordetach(struct knote *kn) { struct socket *so = kn->kn_fp->f_data; - int s = splnet(); + + KERNEL_ASSERT_LOCKED(); SLIST_REMOVE(&so->so_rcv.sb_sel.si_note, kn, knote, kn_selnext); if (SLIST_EMPTY(&so->so_rcv.sb_sel.si_note)) so->so_rcv.sb_flags &= ~SB_KNOTE; - splx(s); } int @@ -1939,12 +1936,12 @@ void filt_sowdetach(struct knote *kn) { struct socket *so = kn->kn_fp->f_data; - int s = splnet(); + + KERNEL_ASSERT_LOCKED(); SLIST_REMOVE(&so->so_snd.sb_sel.si_note, kn, knote, kn_selnext); if (SLIST_EMPTY(&so->so_snd.sb_sel.si_note)) so->so_snd.sb_flags &= ~SB_KNOTE; - splx(s); } int