--- //depot/vendor/freebsd/src/sys/dev/isp/isp_freebsd.c
+++ //depot/user/jhb/cleanup/sys/dev/isp/isp_freebsd.c
@@ -2137,9 +2137,9 @@
 {
 	union ccb *ccb = arg;
 	ispsoftc_t *isp = XS_ISP(ccb);
-	ISP_LOCK(isp);
+
+	ISP_ASSERT_LOCKED(isp);
 	isp_target_putback_atio(ccb);
-	ISP_UNLOCK(isp);
 }
 
 static void
@@ -2147,13 +2147,13 @@
 {
 	isp_tna_t *tp  = arg;
 	ispsoftc_t *isp = tp->isp;
-	ISP_LOCK(isp);
+
+	ISP_ASSERT_LOCKED(isp);
 	if (isp_notify_ack(isp, tp->not)) {
-		(void) timeout(isp_refire_notify_ack, tp, 5);
+		callout_schedule(&tp->timer, 5);
 	} else {
 		free(tp, M_DEVBUF);
 	}
-	ISP_UNLOCK(isp);
 }
 
 
@@ -2170,7 +2170,8 @@
 	if (qe == NULL) {
 		xpt_print(ccb->ccb_h.path,
 		    "%s: Request Queue Overflow\n", __func__);
-		(void) timeout(isp_refire_putback_atio, ccb, 10);
+		callout_reset(&PISP_PCMD(ccb)->wdog, 10,
+		    isp_refire_putback_atio, ccb);
 		return;
 	}
 	memset(qe, 0, QENTRY_LEN);
@@ -5964,7 +5965,9 @@
 				} else {
 					tp->not = NULL;
 				}
-				(void) timeout(isp_refire_notify_ack, tp, 5);
+				callout_init_mtx(&tp->timer, &isp->isp_lock, 0);
+				callout_reset(&tp->timer, 5,
+				    isp_refire_notify_ack, tp);
 			} else {
 				isp_prt(isp, ISP_LOGERR, "you lose- cannot allocate a notify refire");
 			}
--- //depot/vendor/freebsd/src/sys/dev/isp/isp_freebsd.h
+++ //depot/user/jhb/cleanup/sys/dev/isp/isp_freebsd.h
@@ -158,6 +158,7 @@
 	void *isp;
 	void *not;
 	uint8_t data[64];	 /* sb QENTRY_LEN, but order of definitions is wrong */
+	struct callout timer;
 } isp_tna_t;
 
 TAILQ_HEAD(isp_ccbq, ccb_hdr);
@@ -401,6 +402,7 @@
  */
 #define	ISP_LOCK(isp)	mtx_lock(&isp->isp_osinfo.lock)
 #define	ISP_UNLOCK(isp)	mtx_unlock(&isp->isp_osinfo.lock)
+#define	ISP_ASSERT_LOCKED(isp)	mtx_assert(&isp->isp_osinfo.lock, MA_OWNED)
 
 /*
  * Required Macros/Defines