--- //depot/vendor/freebsd/src/sys/netgraph/bluetooth/include/ng_btsocket_l2cap.h
+++ //depot/user/jhb/cleanup/sys/netgraph/bluetooth/include/ng_btsocket_l2cap.h
@@ -162,7 +162,7 @@
 	u_int16_t			 flush_timo; /* flush timeout */   
 	u_int16_t			 link_timo;  /* link timeout */ 
 
-	struct callout_handle		 timo;       /* timeout */
+	struct callout			 timo;       /* timeout */
 
 	u_int32_t			 token;	     /* message token */
 	ng_btsocket_l2cap_rtentry_p	 rt;         /* routing info */
--- //depot/vendor/freebsd/src/sys/netgraph/bluetooth/include/ng_btsocket_rfcomm.h
+++ //depot/user/jhb/cleanup/sys/netgraph/bluetooth/include/ng_btsocket_rfcomm.h
@@ -296,7 +296,7 @@
 	int16_t					 tx_cred; /* TX credits */
 
 	struct mtx				 pcb_mtx; /* PCB lock */
-	struct callout_handle			 timo;    /* timeout */
+	struct callout				 timo;    /* timeout */
 
 	LIST_ENTRY(ng_btsocket_rfcomm_pcb)	 session_next;/* link to next */
 	LIST_ENTRY(ng_btsocket_rfcomm_pcb)	 next;	  /* link to next */
--- //depot/vendor/freebsd/src/sys/netgraph/bluetooth/socket/ng_btsocket_l2cap.c
+++ //depot/user/jhb/cleanup/sys/netgraph/bluetooth/socket/ng_btsocket_l2cap.c
@@ -1967,8 +1967,6 @@
 	pcb->flush_timo = NG_L2CAP_FLUSH_TIMO_DEFAULT;
 	pcb->link_timo = NG_L2CAP_LINK_TIMO_DEFAULT;
 
-	callout_handle_init(&pcb->timo);
-
 	/*
 	 * XXX Mark PCB mutex as DUPOK to prevent "duplicated lock of
 	 * the same type" message. When accepting new L2CAP connection 
@@ -1978,6 +1976,7 @@
 		
 	mtx_init(&pcb->pcb_mtx, "btsocks_l2cap_pcb_mtx", NULL,
 		MTX_DEF|MTX_DUPOK);
+	callout_init_mtx(&pcb->timo, &pcb->pcb_mtx, 0);
 
         /*
 	 * Add the PCB to the list
@@ -2664,8 +2663,8 @@
 
 	if (!(pcb->flags & NG_BTSOCKET_L2CAP_TIMO)) {
 		pcb->flags |= NG_BTSOCKET_L2CAP_TIMO;
-		pcb->timo = timeout(ng_btsocket_l2cap_process_timeout, pcb,
-					bluetooth_l2cap_ertx_timeout());
+		callout_reset(&pcb->timo, bluetooth_l2cap_ertx_timeout(),
+		    ng_btsocket_l2cap_process_timeout, pcb);
 	} else
 		KASSERT(0,
 ("%s: Duplicated socket timeout?!\n", __func__));
@@ -2681,7 +2680,7 @@
 	mtx_assert(&pcb->pcb_mtx, MA_OWNED);
 
 	if (pcb->flags & NG_BTSOCKET_L2CAP_TIMO) {
-		untimeout(ng_btsocket_l2cap_process_timeout, pcb, pcb->timo);
+		callout_stop(&pcb->timo);
 		pcb->flags &= ~NG_BTSOCKET_L2CAP_TIMO;
 	} else
 		KASSERT(0,
@@ -2697,7 +2696,7 @@
 {
 	ng_btsocket_l2cap_pcb_p	pcb = (ng_btsocket_l2cap_pcb_p) xpcb;
 
-	mtx_lock(&pcb->pcb_mtx);
+	mtx_assert(&pcb->pcb_mtx, MA_OWNED);
 
 	pcb->flags &= ~NG_BTSOCKET_L2CAP_TIMO;
 	pcb->so->so_error = ETIMEDOUT;
@@ -2731,8 +2730,6 @@
 "%s: Invalid socket state=%d\n", __func__, pcb->state);
 		break;
 	}
-
-	mtx_unlock(&pcb->pcb_mtx);
 } /* ng_btsocket_l2cap_process_timeout */
 
 /*
--- //depot/vendor/freebsd/src/sys/netgraph/bluetooth/socket/ng_btsocket_rfcomm.c
+++ //depot/user/jhb/cleanup/sys/netgraph/bluetooth/socket/ng_btsocket_rfcomm.c
@@ -434,7 +434,7 @@
 	pcb->rx_cred = RFCOMM_DEFAULT_CREDITS;
 
 	mtx_init(&pcb->pcb_mtx, "btsocks_rfcomm_pcb_mtx", NULL, MTX_DEF);
-	callout_handle_init(&pcb->timo);
+	callout_init_mtx(&pcb->timo, &pcb->pcb_mtx, 0);
 
 	/* Add the PCB to the list */
 	mtx_lock(&ng_btsocket_rfcomm_sockets_mtx);
@@ -3451,8 +3451,8 @@
 	if (!(pcb->flags & NG_BTSOCKET_RFCOMM_DLC_TIMO)) {
 		pcb->flags |= NG_BTSOCKET_RFCOMM_DLC_TIMO;
 		pcb->flags &= ~NG_BTSOCKET_RFCOMM_DLC_TIMEDOUT;
-		pcb->timo = timeout(ng_btsocket_rfcomm_process_timeout, pcb,
-					ng_btsocket_rfcomm_timo * hz);
+		callout_reset(&pcb->timo, ng_btsocket_rfcomm_timo * hz,
+		    ng_btsocket_rfcomm_process_timeout, pcb);
 	} else
 		panic("%s: Duplicated socket timeout?!\n", __func__);
 } /* ng_btsocket_rfcomm_timeout */
@@ -3467,7 +3467,7 @@
 	mtx_assert(&pcb->pcb_mtx, MA_OWNED);
 
 	if (pcb->flags & NG_BTSOCKET_RFCOMM_DLC_TIMO) {
-		untimeout(ng_btsocket_rfcomm_process_timeout, pcb, pcb->timo);
+		callout_stop(&pcb->timo);
 		pcb->flags &= ~NG_BTSOCKET_RFCOMM_DLC_TIMO;
 		pcb->flags &= ~NG_BTSOCKET_RFCOMM_DLC_TIMEDOUT;
 	} else
@@ -3483,7 +3483,7 @@
 {
 	ng_btsocket_rfcomm_pcb_p	pcb = (ng_btsocket_rfcomm_pcb_p) xpcb;
 
-	mtx_lock(&pcb->pcb_mtx);
+	mtx_assert(&pcb->pcb_mtx, MA_OWNED);
 
 	NG_BTSOCKET_RFCOMM_INFO(
 "%s: Timeout, so=%p, dlci=%d, state=%d, flags=%#x\n",
@@ -3510,8 +3510,6 @@
 	}
 
 	ng_btsocket_rfcomm_task_wakeup();
-
-	mtx_unlock(&pcb->pcb_mtx);
 } /* ng_btsocket_rfcomm_process_timeout */
 
 /*