Index: sys/dev/iscsi/iscsi_ioctl.c
===================================================================
RCS file: /cvsroot/src/sys/dev/iscsi/iscsi_ioctl.c,v
retrieving revision 1.34
diff -p -u -r1.34 iscsi_ioctl.c
--- sys/dev/iscsi/iscsi_ioctl.c	25 Nov 2023 10:08:27 -0000	1.34
+++ sys/dev/iscsi/iscsi_ioctl.c	20 Jul 2024 07:29:07 -0000
@@ -1694,8 +1694,8 @@ ccb_timeout_start(ccb_t *ccb, int ticks)
 void
 ccb_timeout_stop(ccb_t *ccb)
 {
-	callout_stop(&ccb->ccb_timeout);
 	mutex_enter(&iscsi_cleanup_mtx);
+	callout_halt(&ccb->ccb_timeout, &iscsi_cleanup_mtx);
 	if (ccb->ccb_timedout == TOUT_QUEUED) {
 		TAILQ_REMOVE(&iscsi_timeout_ccb_list, ccb, ccb_tchain);
 		ccb->ccb_timedout = TOUT_NONE;
Index: sys/dev/iscsi/iscsi_send.c
===================================================================
RCS file: /cvsroot/src/sys/dev/iscsi/iscsi_send.c,v
retrieving revision 1.40
diff -p -u -r1.40 iscsi_send.c
--- sys/dev/iscsi/iscsi_send.c	25 Nov 2023 10:08:27 -0000	1.40
+++ sys/dev/iscsi/iscsi_send.c	20 Jul 2024 07:29:07 -0000
@@ -1723,19 +1723,19 @@ ccb_timeout(ccb_t *ccb)
 {
 	connection_t *conn = ccb->ccb_connection;
 
+	if (conn == NULL) {
+		/* XXX Should never happen */
+		printf("ccb_timeout: num=%d total=%d disp=%d invalid ccb=%p\n",
+			ccb->ccb_num_timeouts+1, ccb->ccb_total_tries,
+			ccb->ccb_disp, ccb);
+		return;
+	}
+
 	ccb->ccb_total_tries++;
 
 	DEBC(conn, 0, ("ccb_timeout: num=%d total=%d disp=%d\n",
 		ccb->ccb_num_timeouts+1, ccb->ccb_total_tries, ccb->ccb_disp));
 
-	/*
-	 * XXX can we time out after connection is closed ?
-	 */
-	if (conn == NULL) {
-		wake_ccb(ccb, ISCSI_STATUS_TIMEOUT);
-		return;
-	}
-
 	if (++ccb->ccb_num_timeouts > MAX_CCB_TIMEOUTS ||
 		ccb->ccb_total_tries > MAX_CCB_TRIES ||
 		ccb->ccb_disp <= CCBDISP_FREE ||