diff --git a/sbin/ifconfig/af_inet.c b/sbin/ifconfig/af_inet.c
index df1d9cab959e..0538f9415272 100644
--- a/sbin/ifconfig/af_inet.c
+++ b/sbin/ifconfig/af_inet.c
@@ -490,7 +490,7 @@ in_postproc(if_ctx *ctx __unused, int newaddr, int ifflags)
 }
 
 static void
-in_status_tunnel(int s)
+in_status_tunnel(if_ctx *ctx)
 {
 	char src[NI_MAXHOST];
 	char dst[NI_MAXHOST];
@@ -500,14 +500,14 @@ in_status_tunnel(int s)
 	memset(&ifr, 0, sizeof(ifr));
 	strlcpy(ifr.ifr_name, name, IFNAMSIZ);
 
-	if (ioctl(s, SIOCGIFPSRCADDR, (caddr_t)&ifr) < 0)
+	if (ioctl_ctx(ctx, SIOCGIFPSRCADDR, (caddr_t)&ifr) < 0)
 		return;
 	if (sa->sa_family != AF_INET)
 		return;
 	if (getnameinfo(sa, sa->sa_len, src, sizeof(src), 0, 0, NI_NUMERICHOST) != 0)
 		src[0] = '\0';
 
-	if (ioctl(s, SIOCGIFPDSTADDR, (caddr_t)&ifr) < 0)
+	if (ioctl_ctx(ctx, SIOCGIFPDSTADDR, (caddr_t)&ifr) < 0)
 		return;
 	if (sa->sa_family != AF_INET)
 		return;
@@ -518,7 +518,7 @@ in_status_tunnel(int s)
 }
 
 static void
-in_set_tunnel(int s, struct addrinfo *srcres, struct addrinfo *dstres)
+in_set_tunnel(if_ctx *ctx, struct addrinfo *srcres, struct addrinfo *dstres)
 {
 	struct in_aliasreq addreq;
 
@@ -527,7 +527,7 @@ in_set_tunnel(int s, struct addrinfo *srcres, struct addrinfo *dstres)
 	memcpy(&addreq.ifra_addr, srcres->ai_addr, srcres->ai_addr->sa_len);
 	memcpy(&addreq.ifra_dstaddr, dstres->ai_addr, dstres->ai_addr->sa_len);
 
-	if (ioctl(s, SIOCSIFPHYADDR, &addreq) < 0)
+	if (ioctl_ctx(ctx, SIOCSIFPHYADDR, &addreq) < 0)
 		warn("SIOCSIFPHYADDR");
 }
 
diff --git a/sbin/ifconfig/af_inet6.c b/sbin/ifconfig/af_inet6.c
index f791646c5133..610fd70c04c1 100644
--- a/sbin/ifconfig/af_inet6.c
+++ b/sbin/ifconfig/af_inet6.c
@@ -647,7 +647,7 @@ in6_postproc(if_ctx *ctx, int newaddr __unused,
 }
 
 static void
-in6_status_tunnel(int s)
+in6_status_tunnel(if_ctx *ctx)
 {
 	char src[NI_MAXHOST];
 	char dst[NI_MAXHOST];
@@ -657,7 +657,7 @@ in6_status_tunnel(int s)
 	memset(&in6_ifr, 0, sizeof(in6_ifr));
 	strlcpy(in6_ifr.ifr_name, name, sizeof(in6_ifr.ifr_name));
 
-	if (ioctl(s, SIOCGIFPSRCADDR_IN6, (caddr_t)&in6_ifr) < 0)
+	if (ioctl_ctx(ctx, SIOCGIFPSRCADDR_IN6, (caddr_t)&in6_ifr) < 0)
 		return;
 	if (sa->sa_family != AF_INET6)
 		return;
@@ -665,7 +665,7 @@ in6_status_tunnel(int s)
 	    NI_NUMERICHOST) != 0)
 		src[0] = '\0';
 
-	if (ioctl(s, SIOCGIFPDSTADDR_IN6, (caddr_t)&in6_ifr) < 0)
+	if (ioctl_ctx(ctx, SIOCGIFPDSTADDR_IN6, (caddr_t)&in6_ifr) < 0)
 		return;
 	if (sa->sa_family != AF_INET6)
 		return;
@@ -677,7 +677,7 @@ in6_status_tunnel(int s)
 }
 
 static void
-in6_set_tunnel(int s, struct addrinfo *srcres, struct addrinfo *dstres)
+in6_set_tunnel(if_ctx *ctx, struct addrinfo *srcres, struct addrinfo *dstres)
 {
 	struct in6_aliasreq in6_addreq; 
 
@@ -687,7 +687,7 @@ in6_set_tunnel(int s, struct addrinfo *srcres, struct addrinfo *dstres)
 	memcpy(&in6_addreq.ifra_dstaddr, dstres->ai_addr,
 	    dstres->ai_addr->sa_len);
 
-	if (ioctl(s, SIOCSIFPHYADDR_IN6, &in6_addreq) < 0)
+	if (ioctl_ctx(ctx, SIOCSIFPHYADDR_IN6, &in6_addreq) < 0)
 		warn("SIOCSIFPHYADDR_IN6");
 }
 
diff --git a/sbin/ifconfig/ifconfig.c b/sbin/ifconfig/ifconfig.c
index 28677e57065c..a250062d69e1 100644
--- a/sbin/ifconfig/ifconfig.c
+++ b/sbin/ifconfig/ifconfig.c
@@ -967,7 +967,7 @@ af_other_status(if_ctx *ctx)
 }
 
 static void
-af_all_tunnel_status(int s)
+af_all_tunnel_status(if_ctx *ctx)
 {
 	struct afswtch *afp;
 	uint8_t afmask[howmany(AF_MAX, NBBY)];
@@ -978,7 +978,7 @@ af_all_tunnel_status(int s)
 			continue;
 		if (afp->af_af != AF_UNSPEC && isset(afmask, afp->af_af))
 			continue;
-		afp->af_status_tunnel(s);
+		afp->af_status_tunnel(ctx);
 		setbit(afmask, afp->af_af);
 	}
 }
@@ -1271,7 +1271,7 @@ settunnel(if_ctx *ctx, const char *src, const char *dst)
 		errx(1,
 		    "source and destination address families do not match");
 
-	afp->af_settunnel(ctx->io_s, srcres, dstres);
+	afp->af_settunnel(ctx, srcres, dstres);
 
 	freeaddrinfo(srcres);
 	freeaddrinfo(dstres);
@@ -1747,7 +1747,7 @@ status(struct ifconfig_args *args, const struct sockaddr_dl *sdl,
 
 	print_ifcap(args, s);
 
-	tunnel_status(s);
+	tunnel_status(ctx);
 
 	for (ift = ifa; ift != NULL; ift = ift->ifa_next) {
 		if (ift->ifa_addr == NULL)
@@ -1794,9 +1794,9 @@ status(struct ifconfig_args *args, const struct sockaddr_dl *sdl,
 #endif
 
 void
-tunnel_status(int s)
+tunnel_status(if_ctx *ctx)
 {
-	af_all_tunnel_status(s);
+	af_all_tunnel_status(ctx);
 }
 
 static void
diff --git a/sbin/ifconfig/ifconfig.h b/sbin/ifconfig/ifconfig.h
index 7b9c64cdaef1..5e0dfcd7e8c5 100644
--- a/sbin/ifconfig/ifconfig.h
+++ b/sbin/ifconfig/ifconfig.h
@@ -181,6 +181,8 @@ typedef void af_other_status_f(if_ctx *ctx);
 typedef void af_postproc_f(if_ctx *ctx, int newaddr, int ifflags);
 typedef	int af_exec_f(if_ctx *ctx, unsigned long action, void *data);
 typedef void af_copyaddr_f(if_ctx *ctx, int to, int from);
+typedef void af_status_tunnel_f(if_ctx *ctx);
+typedef void af_settunnel_f(if_ctx *ctx, struct addrinfo *srcres, struct addrinfo *dstres);
 
 struct afswtch {
 	const char	*af_name;	/* as given on cmd line, e.g. "inet" */
@@ -214,9 +216,8 @@ struct afswtch {
 	struct afswtch	*af_next;
 
 	/* XXX doesn't fit model */
-	void		(*af_status_tunnel)(int);
-	void		(*af_settunnel)(int s, struct addrinfo *srcres,
-				struct addrinfo *dstres);
+	af_status_tunnel_f	*af_status_tunnel;
+	af_settunnel_f	*af_settunnel;
 };
 void	af_register(struct afswtch *);
 int	af_exec_ioctl(if_ctx *ctx, unsigned long action, void *data);
@@ -278,7 +279,7 @@ bool	match_if_flags(struct ifconfig_args *args, int if_flags);
 int	ifconfig(if_ctx *ctx, int iscreate, const struct afswtch *uafp);
 bool	group_member(const char *ifname, const char *match, const char *nomatch);
 void	print_ifcap(struct ifconfig_args *args, int s);
-void	tunnel_status(int s);
+void	tunnel_status(if_ctx *ctx);
 struct afswtch	*af_getbyfamily(int af);
 void	af_other_status(if_ctx *ctx);
 void	print_ifstatus(int s);
diff --git a/sbin/ifconfig/ifconfig_netlink.c b/sbin/ifconfig/ifconfig_netlink.c
index 07e4429cfecb..bded84484a52 100644
--- a/sbin/ifconfig/ifconfig_netlink.c
+++ b/sbin/ifconfig/ifconfig_netlink.c
@@ -366,7 +366,7 @@ status_nl(if_ctx *ctx, struct iface *iface)
 	/* TODO: convert to netlink */
 	strlcpy(ifr.ifr_name, link->ifla_ifname, sizeof(ifr.ifr_name));
 	print_ifcap(args, ctx->io_s);
-	tunnel_status(ctx->io_s);
+	tunnel_status(ctx);
 
 	if (args->allfamilies | (args->afp != NULL && args->afp->af_af == AF_LINK)) {
 		/* Start with link-level */