bstp_create() is called on by bridge/switch_clone_create(). Nothing it touches is reachable, so there's no need for splnet().
ok? Index: net/bridgestp.c =================================================================== RCS file: /cvs/src/sys/net/bridgestp.c,v retrieving revision 1.66 diff -u -p -r1.66 bridgestp.c --- net/bridgestp.c 22 Oct 2018 13:18:23 -0000 1.66 +++ net/bridgestp.c 5 Dec 2018 17:53:51 -0000 @@ -1897,9 +1897,7 @@ struct bstp_state * bstp_create(struct ifnet *ifp) { struct bstp_state *bs; - int s; - s = splnet(); bs = malloc(sizeof(*bs), M_DEVBUF, M_WAITOK|M_ZERO); LIST_INIT(&bs->bs_bplist); @@ -1914,8 +1912,6 @@ bstp_create(struct ifnet *ifp) bs->bs_protover = BSTP_PROTO_RSTP; /* STP instead of RSTP? */ getmicrotime(&bs->bs_last_tc_time); - - splx(s); return (bs); }