line discipline interrupt handlers more or less expect to be called at
spltty() == splimp(), although they have internal splimp()s that are
bogus if this expectation is satisfied. They are called at splsoftty()
from many tty drivers, so they were not protected from being reentered
from their own netisrs. They certainly don't expect that but are
apparently remarkably robust if it occurs. The problem in PR 798 seems
to be caused by pppstart() being reentered and finishing off the output
in progress by following the (stale) sc->sc_outm pointer. Then the
original pppstart() finds garbage in m2 after MFREE(m, m2). slstart()
doesn't have internal state like sc_outm so reentry of it probably only
causes out of order and dropped packets.
7788eaeb2f