The real problem was that ioctl handlers needed to call amr_wait_command() with the list lock held. This not only solves the completion race, it also prevents bounce buffer corruption that could arise from amr_start() being called without the proper locks held. Discussed with: ps MFC After: 3 days