to protect the vlan state in each ifnet (e.g. vlan count). The latter is probably better handled through an ifnet-centric means but since changes are infrequent shouldn't matter for now. Sponsored by: FreeBSD Foundation