- Catch up with ongoing rwatson's socket work;

- Fix a couple of LORs and panics;

- Temporarily remove the code that tries to cleanup sockets that stuck
  on accepting queues (both complete and incomplete). I'm taking an ostrich
  approach here until I find a better way to deal with sockets that were
  disconnected before accepting (i.e. while socket was on complete or
  incomplete accept queue).

2 files changed, 68 insertions, 184 deletions

diff --git a/sys/netgraph/bluetooth/socket/ng_btsocket_l2cap.c b/sys/netgraph/bluetooth/socket/ng_btsocket_l2cap.c
index f6d6fb2..ca31801 100644
--- a/sys/netgraph/bluetooth/socket/ng_btsocket_l2cap.c
+++ b/sys/netgraph/bluetooth/socket/ng_btsocket_l2cap.c
@@ -147,26 +147,26 @@ SYSCTL_INT(_net_bluetooth_l2cap_sockets_seq, OID_AUTO, queue_drops,
  */
 
 static int ng_btsocket_l2cap_process_l2ca_con_req_rsp
-	(struct ng_mesg *, ng_btsocket_l2cap_rtentry_p, struct socket **);
+	(struct ng_mesg *, ng_btsocket_l2cap_rtentry_p);
 static int ng_btsocket_l2cap_process_l2ca_con_rsp_rsp
-	(struct ng_mesg *, ng_btsocket_l2cap_rtentry_p, struct socket **);
+	(struct ng_mesg *, ng_btsocket_l2cap_rtentry_p);
 static int ng_btsocket_l2cap_process_l2ca_con_ind
-	(struct ng_mesg *, ng_btsocket_l2cap_rtentry_p, struct socket **);
+	(struct ng_mesg *, ng_btsocket_l2cap_rtentry_p);
 
 static int ng_btsocket_l2cap_process_l2ca_cfg_req_rsp
-	(struct ng_mesg *, ng_btsocket_l2cap_rtentry_p, struct socket **);
+	(struct ng_mesg *, ng_btsocket_l2cap_rtentry_p);
 static int ng_btsocket_l2cap_process_l2ca_cfg_rsp_rsp
-	(struct ng_mesg *, ng_btsocket_l2cap_rtentry_p, struct socket **);
+	(struct ng_mesg *, ng_btsocket_l2cap_rtentry_p);
 static int ng_btsocket_l2cap_process_l2ca_cfg_ind
-	(struct ng_mesg *, ng_btsocket_l2cap_rtentry_p, struct socket **);
+	(struct ng_mesg *, ng_btsocket_l2cap_rtentry_p);
 
 static int ng_btsocket_l2cap_process_l2ca_discon_rsp
-	(struct ng_mesg *, ng_btsocket_l2cap_rtentry_p, struct socket **);
+	(struct ng_mesg *, ng_btsocket_l2cap_rtentry_p);
 static int ng_btsocket_l2cap_process_l2ca_discon_ind
-	(struct ng_mesg *, ng_btsocket_l2cap_rtentry_p, struct socket **);
+	(struct ng_mesg *, ng_btsocket_l2cap_rtentry_p);
 
 static int ng_btsocket_l2cap_process_l2ca_write_rsp
-	(struct ng_mesg *, ng_btsocket_l2cap_rtentry_p, struct socket **);
+	(struct ng_mesg *, ng_btsocket_l2cap_rtentry_p);
 
 /*
  * Send L2CA_xxx messages to the lower layer
@@ -386,7 +386,7 @@ ng_btsocket_l2cap_node_rcvdata(hook_p hook, item_p item)
 
 static int
 ng_btsocket_l2cap_process_l2ca_con_req_rsp(struct ng_mesg *msg,
-		ng_btsocket_l2cap_rtentry_p rt, struct socket **sop)
+		ng_btsocket_l2cap_rtentry_p rt)
 {
 	ng_l2cap_l2ca_con_op	*op = NULL;
 	ng_btsocket_l2cap_pcb_t	*pcb = NULL;
@@ -453,9 +453,6 @@ ng_btsocket_l2cap_process_l2ca_con_req_rsp(struct ng_mesg *msg,
 			/* ... and close the socket */
 			pcb->state = NG_BTSOCKET_L2CAP_CLOSED;
 			soisdisconnected(pcb->so);
-
-			if (pcb->so->so_state & SS_NOFDREF)
-				*sop = pcb->so;
 		} else {
 			pcb->cfg_state = NG_BTSOCKET_L2CAP_CFG_IN_SENT;
 			pcb->state = NG_BTSOCKET_L2CAP_CONFIGURING;
@@ -472,9 +469,6 @@ ng_btsocket_l2cap_process_l2ca_con_req_rsp(struct ng_mesg *msg,
 		pcb->so->so_error = ng_btsocket_l2cap_result2errno(op->result);
 		pcb->state = NG_BTSOCKET_L2CAP_CLOSED;
 		soisdisconnected(pcb->so); 
-
-		if (pcb->so->so_state & SS_NOFDREF)
-			*sop = pcb->so;
 	}
 
 	mtx_unlock(&pcb->pcb_mtx);
@@ -489,7 +483,7 @@ ng_btsocket_l2cap_process_l2ca_con_req_rsp(struct ng_mesg *msg,
 
 static int
 ng_btsocket_l2cap_process_l2ca_con_rsp_rsp(struct ng_mesg *msg,
-		ng_btsocket_l2cap_rtentry_p rt, struct socket **sop)
+		ng_btsocket_l2cap_rtentry_p rt)
 {
 	ng_l2cap_l2ca_con_rsp_op	*op = NULL;
 	ng_btsocket_l2cap_pcb_t		*pcb = NULL;
@@ -535,9 +529,6 @@ ng_btsocket_l2cap_process_l2ca_con_rsp_rsp(struct ng_mesg *msg,
 		pcb->so->so_error = ng_btsocket_l2cap_result2errno(op->result);
 		pcb->state = NG_BTSOCKET_L2CAP_CLOSED;
 		soisdisconnected(pcb->so);
-
-		if (pcb->so->so_state & SS_NOFDREF)
-			*sop = pcb->so;
 	} else {
 		/* Move to CONFIGURING state and wait for CONFIG_IND */
 		pcb->cfg_state = 0;
@@ -559,7 +550,7 @@ ng_btsocket_l2cap_process_l2ca_con_rsp_rsp(struct ng_mesg *msg,
 
 static int
 ng_btsocket_l2cap_process_l2ca_con_ind(struct ng_mesg *msg,
-		ng_btsocket_l2cap_rtentry_p rt, struct socket **sop)
+		ng_btsocket_l2cap_rtentry_p rt)
 {
 	ng_l2cap_l2ca_con_ind_ip	*ip = NULL;
 	ng_btsocket_l2cap_pcb_t		*pcb = NULL, *pcb1 = NULL;
@@ -646,9 +637,6 @@ respond:
 			pcb1->so->so_error = error;
 			pcb1->state = NG_BTSOCKET_L2CAP_CLOSED;
 			soisdisconnected(pcb1->so);
-
-			if (pcb1->so->so_state & SS_NOFDREF)
-				*sop = pcb1->so;
 		} else {
 			pcb1->state = NG_BTSOCKET_L2CAP_CONNECTING;
 			soisconnecting(pcb1->so);
@@ -673,7 +661,7 @@ respond:
 
 static int
 ng_btsocket_l2cap_process_l2ca_cfg_req_rsp(struct ng_mesg *msg,
-		ng_btsocket_l2cap_rtentry_p rt, struct socket **sop)
+		ng_btsocket_l2cap_rtentry_p rt)
 {
 	ng_l2cap_l2ca_cfg_op	*op = NULL;
 	ng_btsocket_l2cap_pcb_p	 pcb = NULL;
@@ -776,9 +764,6 @@ ng_btsocket_l2cap_process_l2ca_cfg_req_rsp(struct ng_mesg *msg,
 		/* ... and close the socket */
 		pcb->state = NG_BTSOCKET_L2CAP_CLOSED;
 		soisdisconnected(pcb->so);
-
-		if (pcb->so->so_state & SS_NOFDREF)
-			*sop = pcb->so;
 	}
 
 	mtx_unlock(&pcb->pcb_mtx);
@@ -793,7 +778,7 @@ ng_btsocket_l2cap_process_l2ca_cfg_req_rsp(struct ng_mesg *msg,
 
 static int
 ng_btsocket_l2cap_process_l2ca_cfg_rsp_rsp(struct ng_mesg *msg,
-		ng_btsocket_l2cap_rtentry_p rt, struct socket **sop)
+		ng_btsocket_l2cap_rtentry_p rt)
 {
 	ng_l2cap_l2ca_cfg_rsp_op	*op = NULL;
 	ng_btsocket_l2cap_pcb_t		*pcb = NULL;
@@ -876,9 +861,6 @@ disconnect:
 	pcb->state = NG_BTSOCKET_L2CAP_CLOSED;
 	soisdisconnected(pcb->so);
 
-	if (pcb->so->so_state & SS_NOFDREF)
-		*sop = pcb->so;
-
 	mtx_unlock(&pcb->pcb_mtx);
 	mtx_unlock(&ng_btsocket_l2cap_sockets_mtx);
 
@@ -891,7 +873,7 @@ disconnect:
 
 static int
 ng_btsocket_l2cap_process_l2ca_cfg_ind(struct ng_mesg *msg,
-		ng_btsocket_l2cap_rtentry_p rt, struct socket **sop)
+		ng_btsocket_l2cap_rtentry_p rt)
 {
 	ng_l2cap_l2ca_cfg_ind_ip	*ip = NULL;
 	ng_btsocket_l2cap_pcb_t		*pcb = NULL;
@@ -959,9 +941,6 @@ ng_btsocket_l2cap_process_l2ca_cfg_ind(struct ng_mesg *msg,
 			/* ... and close the socket */
 			pcb->state = NG_BTSOCKET_L2CAP_CLOSED;
 			soisdisconnected(pcb->so);
-
-			if (pcb->so->so_state & SS_NOFDREF)
-				*sop = pcb->so;
 		} else
 			pcb->cfg_state |= NG_BTSOCKET_L2CAP_CFG_OUT_SENT;
 	}
@@ -978,7 +957,7 @@ ng_btsocket_l2cap_process_l2ca_cfg_ind(struct ng_mesg *msg,
 
 static int
 ng_btsocket_l2cap_process_l2ca_discon_rsp(struct ng_mesg *msg,
-		ng_btsocket_l2cap_rtentry_p rt, struct socket **sop)
+		ng_btsocket_l2cap_rtentry_p rt)
 {
 	ng_l2cap_l2ca_discon_op	*op = NULL;
 	ng_btsocket_l2cap_pcb_t	*pcb = NULL;
@@ -1021,9 +1000,6 @@ ng_btsocket_l2cap_process_l2ca_discon_rsp(struct ng_mesg *msg,
 
 		pcb->state = NG_BTSOCKET_L2CAP_CLOSED;
 		soisdisconnected(pcb->so);
-
-		if (pcb->so->so_state & SS_NOFDREF)
-			*sop = pcb->so;
 	}
 
 	mtx_unlock(&pcb->pcb_mtx);
@@ -1038,7 +1014,7 @@ ng_btsocket_l2cap_process_l2ca_discon_rsp(struct ng_mesg *msg,
 
 static int
 ng_btsocket_l2cap_process_l2ca_discon_ind(struct ng_mesg *msg,
-		ng_btsocket_l2cap_rtentry_p rt, struct socket **sop)
+		ng_btsocket_l2cap_rtentry_p rt)
 {
 	ng_l2cap_l2ca_discon_ind_ip	*ip = NULL;
 	ng_btsocket_l2cap_pcb_t		*pcb = NULL;
@@ -1082,9 +1058,6 @@ ng_btsocket_l2cap_process_l2ca_discon_ind(struct ng_mesg *msg,
 	pcb->state = NG_BTSOCKET_L2CAP_CLOSED;
 	soisdisconnected(pcb->so);
 
-	if (pcb->so->so_state & SS_NOFDREF)
-		*sop = pcb->so;
-
 	mtx_unlock(&pcb->pcb_mtx);
 	mtx_unlock(&ng_btsocket_l2cap_sockets_mtx);
 
@@ -1097,7 +1070,7 @@ ng_btsocket_l2cap_process_l2ca_discon_ind(struct ng_mesg *msg,
 
 static int 
 ng_btsocket_l2cap_process_l2ca_write_rsp(struct ng_mesg *msg,
-		ng_btsocket_l2cap_rtentry_p rt, struct socket **sop)
+		ng_btsocket_l2cap_rtentry_p rt)
 {
 	ng_l2cap_l2ca_write_op	*op = NULL;
 	ng_btsocket_l2cap_pcb_t	*pcb = NULL;
@@ -1624,8 +1597,7 @@ ng_btsocket_l2cap_default_msg_input(struct ng_mesg *msg, hook_p hook)
 static void
 ng_btsocket_l2cap_l2ca_msg_input(struct ng_mesg *msg, hook_p hook)
 {
-	ng_btsocket_l2cap_rtentry_p	 rt = NULL;
-	struct socket			*so = NULL;
+	ng_btsocket_l2cap_rtentry_p	rt = NULL;
 
 	if (hook == NULL) {
 		NG_BTSOCKET_L2CAP_ALERT(
@@ -1642,39 +1614,39 @@ ng_btsocket_l2cap_l2ca_msg_input(struct ng_mesg *msg, hook_p hook)
 
 	switch (msg->header.cmd) {
 	case NGM_L2CAP_L2CA_CON: /* L2CA_Connect response */
-		ng_btsocket_l2cap_process_l2ca_con_req_rsp(msg, rt, &so);
+		ng_btsocket_l2cap_process_l2ca_con_req_rsp(msg, rt);
 		break;
 
 	case NGM_L2CAP_L2CA_CON_RSP: /* L2CA_ConnectRsp response */
-		ng_btsocket_l2cap_process_l2ca_con_rsp_rsp(msg, rt, &so);
+		ng_btsocket_l2cap_process_l2ca_con_rsp_rsp(msg, rt);
 		break;
 
 	case NGM_L2CAP_L2CA_CON_IND: /* L2CA_Connect indicator */
-		ng_btsocket_l2cap_process_l2ca_con_ind(msg, rt, &so);
+		ng_btsocket_l2cap_process_l2ca_con_ind(msg, rt);
 		break;
 
 	case NGM_L2CAP_L2CA_CFG: /* L2CA_Config response */
-		ng_btsocket_l2cap_process_l2ca_cfg_req_rsp(msg, rt, &so);
+		ng_btsocket_l2cap_process_l2ca_cfg_req_rsp(msg, rt);
 		break;
 
 	case NGM_L2CAP_L2CA_CFG_RSP: /* L2CA_ConfigRsp response */
-		ng_btsocket_l2cap_process_l2ca_cfg_rsp_rsp(msg, rt, &so);
+		ng_btsocket_l2cap_process_l2ca_cfg_rsp_rsp(msg, rt);
 		break;
 
 	case NGM_L2CAP_L2CA_CFG_IND: /* L2CA_Config indicator */
-		ng_btsocket_l2cap_process_l2ca_cfg_ind(msg, rt, &so);
+		ng_btsocket_l2cap_process_l2ca_cfg_ind(msg, rt);
 		break;
 
 	case NGM_L2CAP_L2CA_DISCON: /* L2CA_Disconnect response */
-		ng_btsocket_l2cap_process_l2ca_discon_rsp(msg, rt, &so);
+		ng_btsocket_l2cap_process_l2ca_discon_rsp(msg, rt);
 		break;
 
 	case NGM_L2CAP_L2CA_DISCON_IND: /* L2CA_Disconnect indicator */
-		ng_btsocket_l2cap_process_l2ca_discon_ind(msg, rt, &so);
+		ng_btsocket_l2cap_process_l2ca_discon_ind(msg, rt);
 		break;
 
 	case NGM_L2CAP_L2CA_WRITE: /* L2CA_Write response */
-		ng_btsocket_l2cap_process_l2ca_write_rsp(msg, rt, &so);
+		ng_btsocket_l2cap_process_l2ca_write_rsp(msg, rt);
 		break;
 
 	/* XXX FIXME add other L2CA messages */
@@ -1686,9 +1658,6 @@ ng_btsocket_l2cap_l2ca_msg_input(struct ng_mesg *msg, hook_p hook)
 	}
 drop:
 	NG_FREE_MSG(msg);
-
-	if (so != NULL)
-		ng_btsocket_l2cap_detach(so);
 } /* ng_btsocket_l2cap_l2ca_msg_input */
 
 /*
@@ -1793,30 +1762,9 @@ ng_btsocket_l2cap_rtclean(void *context, int pending)
 			pcb->token = 0;
 			pcb->cid = 0;
 			pcb->rt = NULL;
-
-			if (pcb->so->so_state & SS_NOFDREF) {
-				struct socket	*so = pcb->so;
-
-				LIST_REMOVE(pcb, next);
-
-				mtx_unlock(&pcb->pcb_mtx);
-
-				mtx_destroy(&pcb->pcb_mtx);
-				bzero(pcb, sizeof(*pcb));
-				FREE(pcb, M_NETGRAPH_BTSOCKET_L2CAP);
-
-				soisdisconnected(so);
-				ACCEPT_LOCK();
-				SOCK_LOCK(so);
-				so->so_pcb = NULL;
-				sotryfree(so);
-
-				goto next;
-			}
 		}
 
 		mtx_unlock(&pcb->pcb_mtx);
-next:
 		pcb = pcb_next;
 	}
 
@@ -2729,8 +2677,7 @@ ng_btsocket_l2cap_untimeout(ng_btsocket_l2cap_pcb_p pcb)
 static void
 ng_btsocket_l2cap_process_timeout(void *xpcb)
 {
-	ng_btsocket_l2cap_pcb_p	 pcb = (ng_btsocket_l2cap_pcb_p) xpcb;
-	struct socket		*so = NULL;
+	ng_btsocket_l2cap_pcb_p	pcb = (ng_btsocket_l2cap_pcb_p) xpcb;
 
 	mtx_lock(&pcb->pcb_mtx);
 
@@ -2747,9 +2694,6 @@ ng_btsocket_l2cap_process_timeout(void *xpcb)
 		/* ... and close the socket */
 		pcb->state = NG_BTSOCKET_L2CAP_CLOSED;
 		soisdisconnected(pcb->so);
-
-		if (pcb->so->so_state & SS_NOFDREF)
-			so = pcb->so;
 		break;
 
 	case NG_BTSOCKET_L2CAP_OPEN:
@@ -2762,9 +2706,6 @@ ng_btsocket_l2cap_process_timeout(void *xpcb)
 		/* Disconnect timeout - disconnect the socket anyway */
 		pcb->state = NG_BTSOCKET_L2CAP_CLOSED;
 		soisdisconnected(pcb->so);
-
-		if (pcb->so->so_state & SS_NOFDREF)
-			so = pcb->so;
 		break;
 
 	default:
@@ -2774,9 +2715,6 @@ ng_btsocket_l2cap_process_timeout(void *xpcb)
 	}
 
 	mtx_unlock(&pcb->pcb_mtx);
-
-	if (so != NULL)
-		ng_btsocket_l2cap_detach(so);
 } /* ng_btsocket_l2cap_process_timeout */
 
 /*
diff --git a/sys/netgraph/bluetooth/socket/ng_btsocket_rfcomm.c b/sys/netgraph/bluetooth/socket/ng_btsocket_rfcomm.c
index 760412a..96278d6 100644
--- a/sys/netgraph/bluetooth/socket/ng_btsocket_rfcomm.c
+++ b/sys/netgraph/bluetooth/socket/ng_btsocket_rfcomm.c
@@ -165,7 +165,7 @@ static int ng_btsocket_rfcomm_send_credits
 
 static int ng_btsocket_rfcomm_pcb_send
 	(ng_btsocket_rfcomm_pcb_p pcb, int limit);
-static int ng_btsocket_rfcomm_pcb_kill
+static void ng_btsocket_rfcomm_pcb_kill
 	(ng_btsocket_rfcomm_pcb_p pcb, int error);
 static ng_btsocket_rfcomm_pcb_p ng_btsocket_rfcomm_pcb_by_channel
 	(bdaddr_p src, int channel);
@@ -774,11 +774,10 @@ ng_btsocket_rfcomm_disconnect(struct socket *so)
 		ng_btsocket_rfcomm_task_wakeup();
 		break;
 
-/*
- * 	case NG_BTSOCKET_RFCOMM_DLC_CLOSED:
- *	case NG_BTSOCKET_RFCOMM_DLC_W4_CONNECT:
- *	case NG_BTSOCKET_RFCOMM_DLC_DISCONNECTING:
- */
+	case NG_BTSOCKET_RFCOMM_DLC_CLOSED:
+	case NG_BTSOCKET_RFCOMM_DLC_W4_CONNECT:
+		break;
+
 	default:
 		panic("%s: Invalid DLC state=%d, flags=%#x\n",
 			__func__, pcb->state, pcb->flags);
@@ -828,6 +827,7 @@ ng_btsocket_rfcomm_listen(struct socket *so, int backlog, struct thread *td)
 	mtx_lock(&ng_btsocket_rfcomm_sessions_mtx);
 	SOCK_LOCK(so);
 	error = solisten_proto_check(so);
+	SOCK_UNLOCK(so);
 	if (error != 0)
 		goto out;
 
@@ -859,9 +859,10 @@ ng_btsocket_rfcomm_listen(struct socket *so, int backlog, struct thread *td)
 			goto out;
 		l2so = NULL;
 	}
+	SOCK_LOCK(so);
 	solisten_proto(so, backlog);
-out:
 	SOCK_UNLOCK(so);
+out:
 	mtx_unlock(&ng_btsocket_rfcomm_sessions_mtx);
 	/*
 	 * If we still have an l2so reference here, it's unneeded, so release
@@ -1161,9 +1162,8 @@ ng_btsocket_rfcomm_connect_ind(ng_btsocket_rfcomm_session_p s, int channel)
 static void
 ng_btsocket_rfcomm_connect_cfm(ng_btsocket_rfcomm_session_p s)
 {
-	ng_btsocket_rfcomm_pcb_p	 pcb = NULL, pcb_next = NULL;
-	struct socket			*so = NULL;
-	int				 error;
+	ng_btsocket_rfcomm_pcb_p	pcb = NULL, pcb_next = NULL;
+	int				error;
 
 	mtx_assert(&s->session_mtx, MA_OWNED);
 
@@ -1187,17 +1187,12 @@ ng_btsocket_rfcomm_connect_cfm(ng_btsocket_rfcomm_session_p s)
 			error = ng_btsocket_rfcomm_send_pn(pcb);
 			if (error == 0)
 				pcb->state = NG_BTSOCKET_RFCOMM_DLC_CONFIGURING;
-			else if (ng_btsocket_rfcomm_pcb_kill(pcb, error))
-				so = pcb->so;
-			else 
-				so = NULL;
+			else
+				ng_btsocket_rfcomm_pcb_kill(pcb, error);
 		}
 
 		mtx_unlock(&pcb->pcb_mtx);
 		pcb = pcb_next;
-
-		if (so != NULL)
-			ng_btsocket_rfcomm_detach(so);
 	}
 } /* ng_btsocket_rfcomm_connect_cfm */
 
@@ -1632,9 +1627,8 @@ ng_btsocket_rfcomm_session_send(ng_btsocket_rfcomm_session_p s)
 static void
 ng_btsocket_rfcomm_session_clean(ng_btsocket_rfcomm_session_p s)
 {
-	ng_btsocket_rfcomm_pcb_p	 pcb = NULL, pcb_next = NULL;
-	struct socket			*so = NULL;
-	int				 error;
+	ng_btsocket_rfcomm_pcb_p	pcb = NULL, pcb_next = NULL;
+	int				error;
 
 	mtx_assert(&s->session_mtx, MA_OWNED);
 
@@ -1656,16 +1650,10 @@ ng_btsocket_rfcomm_session_clean(ng_btsocket_rfcomm_session_p s)
 		else
 			error = ECONNREFUSED;
 
-		if (ng_btsocket_rfcomm_pcb_kill(pcb, error))
-			so = pcb->so;
-		else
-			so = NULL;
+		ng_btsocket_rfcomm_pcb_kill(pcb, error);
 
 		mtx_unlock(&pcb->pcb_mtx);
 		pcb = pcb_next;
-
-		if (so != NULL)
-			ng_btsocket_rfcomm_detach(so);
 	}
 } /* ng_btsocket_rfcomm_session_clean */
 
@@ -1676,9 +1664,8 @@ ng_btsocket_rfcomm_session_clean(ng_btsocket_rfcomm_session_p s)
 static void
 ng_btsocket_rfcomm_session_process_pcb(ng_btsocket_rfcomm_session_p s)
 {
-	ng_btsocket_rfcomm_pcb_p	 pcb = NULL, pcb_next = NULL;
-	struct socket			*so = NULL;
-	int				 error;
+	ng_btsocket_rfcomm_pcb_p	pcb = NULL, pcb_next = NULL;
+	int				error;
 
 	mtx_assert(&s->session_mtx, MA_OWNED);
 
@@ -1688,8 +1675,6 @@ ng_btsocket_rfcomm_session_process_pcb(ng_btsocket_rfcomm_session_p s)
 	 */
 
 	for (pcb = LIST_FIRST(&s->dlcs); pcb != NULL; ) {
-		so = NULL;
-
 		mtx_lock(&pcb->pcb_mtx);
 		pcb_next = LIST_NEXT(pcb, session_next);
 
@@ -1701,12 +1686,10 @@ ng_btsocket_rfcomm_session_process_pcb(ng_btsocket_rfcomm_session_p s)
 		 */
 
 		case NG_BTSOCKET_RFCOMM_DLC_W4_CONNECT:
-			if (pcb->flags & NG_BTSOCKET_RFCOMM_DLC_DETACHED) {
-				if (ng_btsocket_rfcomm_pcb_kill(pcb, 0))
-					so = pcb->so;
-			} else if (pcb->flags & NG_BTSOCKET_RFCOMM_DLC_TIMEDOUT)
-				if (ng_btsocket_rfcomm_pcb_kill(pcb, ETIMEDOUT))
-					so = pcb->so;
+			if (pcb->flags & NG_BTSOCKET_RFCOMM_DLC_DETACHED)
+				ng_btsocket_rfcomm_pcb_kill(pcb, 0);
+			else if (pcb->flags & NG_BTSOCKET_RFCOMM_DLC_TIMEDOUT)
+				ng_btsocket_rfcomm_pcb_kill(pcb, ETIMEDOUT);
 			break;
 
 		/*
@@ -1718,8 +1701,7 @@ ng_btsocket_rfcomm_session_process_pcb(ng_btsocket_rfcomm_session_p s)
 		case NG_BTSOCKET_RFCOMM_DLC_CONFIGURING:
 		case NG_BTSOCKET_RFCOMM_DLC_CONNECTING:
 			if (pcb->flags & NG_BTSOCKET_RFCOMM_DLC_TIMEDOUT)
-				if (ng_btsocket_rfcomm_pcb_kill(pcb, ETIMEDOUT))
-					so = pcb->so;
+				ng_btsocket_rfcomm_pcb_kill(pcb, ETIMEDOUT);
 			break;
 
 		/*
@@ -1734,8 +1716,7 @@ ng_btsocket_rfcomm_session_process_pcb(ng_btsocket_rfcomm_session_p s)
 		case NG_BTSOCKET_RFCOMM_DLC_CONNECTED:
 			error = ng_btsocket_rfcomm_pcb_send(pcb, ALOT);
 			if (error != 0)
-				if (ng_btsocket_rfcomm_pcb_kill(pcb, error))
-					so = pcb->so;
+				ng_btsocket_rfcomm_pcb_kill(pcb, error);
 			break;
 
 		/*
@@ -1754,11 +1735,10 @@ ng_btsocket_rfcomm_session_process_pcb(ng_btsocket_rfcomm_session_p s)
 						pcb->dlci);
 				if (error == 0)
 					ng_btsocket_rfcomm_timeout(pcb);
-				else if (ng_btsocket_rfcomm_pcb_kill(pcb,error))
-					so = pcb->so;
+				else
+					ng_btsocket_rfcomm_pcb_kill(pcb, error);
 			} else if (pcb->flags & NG_BTSOCKET_RFCOMM_DLC_TIMEDOUT)
-				if (ng_btsocket_rfcomm_pcb_kill(pcb, ETIMEDOUT))
-					so = pcb->so;
+				ng_btsocket_rfcomm_pcb_kill(pcb, ETIMEDOUT);
 			break;
 		
 /*		case NG_BTSOCKET_RFCOMM_DLC_CLOSED: */
@@ -1770,9 +1750,6 @@ ng_btsocket_rfcomm_session_process_pcb(ng_btsocket_rfcomm_session_p s)
 
 		mtx_unlock(&pcb->pcb_mtx);
 		pcb = pcb_next;
-
-		if (so != NULL)
-			ng_btsocket_rfcomm_detach(so);
 	}
 } /* ng_btsocket_rfcomm_session_process_pcb */
 
@@ -1955,9 +1932,8 @@ ng_btsocket_rfcomm_receive_frame(ng_btsocket_rfcomm_session_p s,
 static int
 ng_btsocket_rfcomm_receive_sabm(ng_btsocket_rfcomm_session_p s, int dlci)
 {
-	ng_btsocket_rfcomm_pcb_p	 pcb = NULL;
-	struct socket			*so = NULL;
-	int				 error = 0;
+	ng_btsocket_rfcomm_pcb_p	pcb = NULL;
+	int				error = 0;
 
 	mtx_assert(&s->session_mtx, MA_OWNED);
 
@@ -2028,14 +2004,11 @@ ng_btsocket_rfcomm_receive_sabm(ng_btsocket_rfcomm_session_p s, int dlci)
 		if (error == 0) {
 			pcb->state = NG_BTSOCKET_RFCOMM_DLC_CONNECTED;
 			soisconnected(pcb->so);
-		} else if (ng_btsocket_rfcomm_pcb_kill(pcb, error))
-			so = pcb->so;
+		} else
+			ng_btsocket_rfcomm_pcb_kill(pcb, error);
 
 		mtx_unlock(&pcb->pcb_mtx);
 
-		if (so != NULL)
-			ng_btsocket_rfcomm_detach(so);
-
 		return (error);
 	}
 
@@ -2057,13 +2030,10 @@ ng_btsocket_rfcomm_receive_sabm(ng_btsocket_rfcomm_session_p s, int dlci)
 		if (error == 0) {
 			pcb->state = NG_BTSOCKET_RFCOMM_DLC_CONNECTED;
 			soisconnected(pcb->so);
-		} else if (ng_btsocket_rfcomm_pcb_kill(pcb, error))
-			so = pcb->so;
+		} else
+			ng_btsocket_rfcomm_pcb_kill(pcb, error);
 
 		mtx_unlock(&pcb->pcb_mtx);
-
-		if (so != NULL)
-			ng_btsocket_rfcomm_detach(so);
 	} else
 		/* Nobody is listen()ing on the requested DLCI */
 		error = ng_btsocket_rfcomm_send_command(s,RFCOMM_FRAME_DM,dlci);
@@ -2103,8 +2073,7 @@ ng_btsocket_rfcomm_receive_disc(ng_btsocket_rfcomm_session_p s, int dlci)
 	} else {
 		pcb = ng_btsocket_rfcomm_pcb_by_dlci(s, dlci);
 		if (pcb != NULL) {
-			struct socket	*so = NULL;
-			int		 err;
+			int	err;
 
 			mtx_lock(&pcb->pcb_mtx);
 
@@ -2120,13 +2089,9 @@ ng_btsocket_rfcomm_receive_disc(ng_btsocket_rfcomm_session_p s, int dlci)
 			else
 				err = ECONNREFUSED;
 
-			if (ng_btsocket_rfcomm_pcb_kill(pcb, err))
-				so = pcb->so;
+			ng_btsocket_rfcomm_pcb_kill(pcb, err);
 
 			mtx_unlock(&pcb->pcb_mtx);
-
-			if (so != NULL)
-				ng_btsocket_rfcomm_detach(so);
 		} else {
 			NG_BTSOCKET_RFCOMM_WARN(
 "%s: Got DISC for non-existing dlci=%d\n", __func__, dlci);
@@ -2183,8 +2148,6 @@ ng_btsocket_rfcomm_receive_ua(ng_btsocket_rfcomm_session_p s, int dlci)
 	/* Check if we have this DLCI */
 	pcb = ng_btsocket_rfcomm_pcb_by_dlci(s, dlci);
 	if (pcb != NULL) {
-		struct socket	*so = NULL;
-
 		mtx_lock(&pcb->pcb_mtx);
 
 		NG_BTSOCKET_RFCOMM_INFO(
@@ -2203,8 +2166,7 @@ ng_btsocket_rfcomm_receive_ua(ng_btsocket_rfcomm_session_p s, int dlci)
 			break;
 
 		case NG_BTSOCKET_RFCOMM_DLC_DISCONNECTING:
-			if (ng_btsocket_rfcomm_pcb_kill(pcb, 0))
-				so = pcb->so;
+			ng_btsocket_rfcomm_pcb_kill(pcb, 0);
 			break;
 
 		default:
@@ -2216,9 +2178,6 @@ ng_btsocket_rfcomm_receive_ua(ng_btsocket_rfcomm_session_p s, int dlci)
 		}
 
 		mtx_unlock(&pcb->pcb_mtx);
-
-		if (so != NULL)
-			ng_btsocket_rfcomm_detach(so);
 	} else {
 		NG_BTSOCKET_RFCOMM_WARN(
 "%s: Got UA for non-existing dlci=%d\n", __func__, dlci);
@@ -2253,8 +2212,6 @@ ng_btsocket_rfcomm_receive_dm(ng_btsocket_rfcomm_session_p s, int dlci)
 	} else {
 		pcb = ng_btsocket_rfcomm_pcb_by_dlci(s, dlci);
 		if (pcb != NULL) {
-			struct socket	*so = NULL;
-
 			mtx_lock(&pcb->pcb_mtx);
 
 			NG_BTSOCKET_RFCOMM_INFO(
@@ -2266,13 +2223,9 @@ ng_btsocket_rfcomm_receive_dm(ng_btsocket_rfcomm_session_p s, int dlci)
 			else
 				error = ECONNREFUSED;
 
-			if (ng_btsocket_rfcomm_pcb_kill(pcb, error))
-				so = pcb->so;
+			ng_btsocket_rfcomm_pcb_kill(pcb, error);
 
 			mtx_unlock(&pcb->pcb_mtx);
-
-			if (so != NULL)
-				ng_btsocket_rfcomm_detach(so);
 		} else
 			NG_BTSOCKET_RFCOMM_WARN(
 "%s: Got DM for non-existing dlci=%d\n", __func__, dlci);
@@ -2881,8 +2834,6 @@ ng_btsocket_rfcomm_receive_pn(ng_btsocket_rfcomm_session_p s, struct mbuf *m0)
 		pcb = ng_btsocket_rfcomm_connect_ind(s,
 				RFCOMM_SRVCHANNEL(pn->dlci));
 		if (pcb != NULL) {
-			struct socket	*so = NULL;
-
 			mtx_lock(&pcb->pcb_mtx);
 
 			pcb->dlci = pn->dlci;
@@ -2907,13 +2858,10 @@ ng_btsocket_rfcomm_receive_pn(ng_btsocket_rfcomm_session_p s, struct mbuf *m0)
 				ng_btsocket_rfcomm_timeout(pcb);
 				pcb->state = NG_BTSOCKET_RFCOMM_DLC_CONNECTING;
 				soisconnecting(pcb->so);
-			} else if (ng_btsocket_rfcomm_pcb_kill(pcb, error))
-				so = pcb->so;
+			} else
+				ng_btsocket_rfcomm_pcb_kill(pcb, error);
 
 			mtx_unlock(&pcb->pcb_mtx);
-
-			if (so != NULL)
-				ng_btsocket_rfcomm_detach(so);
 		} else {
 			/* Nobody is listen()ing on this channel */
 			error = ng_btsocket_rfcomm_send_command(s,
@@ -3321,7 +3269,7 @@ ng_btsocket_rfcomm_pcb_send(ng_btsocket_rfcomm_pcb_p pcb, int limit)
  * Caller must hold pcb->pcb_mtx and pcb->session->session_mtx
  */
 
-static int
+static void
 ng_btsocket_rfcomm_pcb_kill(ng_btsocket_rfcomm_pcb_p pcb, int error)
 {
 	ng_btsocket_rfcomm_session_p	s = pcb->session;
@@ -3390,8 +3338,6 @@ ng_btsocket_rfcomm_pcb_kill(ng_btsocket_rfcomm_pcb_p pcb, int error)
 
 		ng_btsocket_rfcomm_task_wakeup();
 	}
-
-	return (pcb->so->so_state & SS_NOFDREF);
 } /* ng_btsocket_rfcomm_pcb_kill */
 
 /*