diff -r 6183aa8dcdf4 sys/net/if_spppsubr.c
--- a/sys/net/if_spppsubr.c	Sun Feb 01 13:15:54 2026 +0000
+++ b/sys/net/if_spppsubr.c	Sun Feb 08 20:49:53 2026 +0000
@@ -3877,15 +3877,26 @@
 }
 
 static void
+sppp_rt_ifmsg(struct sppp *sp)
+{
+	struct ifnet *ifp;
+
+	KASSERT(SPPP_WLOCKED(sp));
+
+	ifp = &sp->pp_if;
+	SPPP_UNLOCK(sp);
+	rt_ifmsg(ifp);
+	SPPP_LOCK(sp, RW_WRITER);
+}
+
+static void
 sppp_ipcp_tlu(struct sppp *sp)
 {
 #ifdef INET
-	struct ifnet *ifp;
 
 	KASSERT(SPPP_WLOCKED(sp));
 
 	SPPP_LOG(sp, LOG_INFO, "IPCP layer up\n");
-	ifp = &sp->pp_if;
 	if ((sp->ipcp.flags & IPCP_MYADDR_DYN) &&
 	    ((sp->ipcp.flags & IPCP_MYADDR_SEEN) == 0)) {
 		SPPP_LOG(sp, LOG_WARNING,
@@ -3895,7 +3906,7 @@
 	} else {
 		/* we are up. Set addresses and notify anyone interested */
 		sppp_set_ip_addrs(sp);
-		rt_ifmsg(ifp);
+		sppp_rt_ifmsg(sp);
 	}
 #endif
 }
@@ -3904,13 +3915,11 @@
 sppp_ipcp_tld(struct sppp *sp)
 {
 #ifdef INET
-	struct ifnet *ifp;
 
 	KASSERT(SPPP_WLOCKED(sp));
 
 	SPPP_LOG(sp, LOG_INFO, "IPCP layer down\n");
-	ifp = &sp->pp_if;
-	rt_ifmsg(ifp);
+	sppp_rt_ifmsg(sp);
 #endif
 }
 
@@ -4445,27 +4454,23 @@
 static void
 sppp_ipv6cp_tlu(struct sppp *sp)
 {
-	struct ifnet *ifp;
 
 	KASSERT(SPPP_WLOCKED(sp));
 
 	SPPP_LOG(sp, LOG_INFO, "IPv6CP layer up\n");
-	ifp = &sp->pp_if;
 	/* we are up - notify isdn daemon */
 	sppp_notify_con_wlocked(sp);
-	rt_ifmsg(ifp);
+	sppp_rt_ifmsg(sp);
 }
 
 static void
 sppp_ipv6cp_tld(struct sppp *sp)
 {
-	struct ifnet *ifp;
 
 	KASSERT(SPPP_WLOCKED(sp));
 
 	SPPP_LOG(sp, LOG_INFO, "IPv6CP layer down\n");
-	ifp = &sp->pp_if;
-	rt_ifmsg(ifp);
+	sppp_rt_ifmsg(sp);
 }
 
 static void