Index: sys/kern/kern_sendfile.c
===================================================================
--- sys/kern/kern_sendfile.c	(revision 315926)
+++ sys/kern/kern_sendfile.c	(working copy)
@@ -80,7 +80,7 @@ struct sf_io {
 	volatile u_int	nios;
 	u_int		error;
 	int		npages;
-	struct file	*sock_fp;
+	struct socket	*so;
 	struct mbuf	*m;
 	vm_page_t	pa[];
 };
@@ -255,7 +255,7 @@ static void
 sendfile_iodone(void *arg, vm_page_t *pg, int count, int error)
 {
 	struct sf_io *sfio = arg;
-	struct socket *so;
+	struct socket *so = sfio->so;
 
 	for (int i = 0; i < count; i++)
 		if (pg[i] != bogus_page)
@@ -267,8 +267,6 @@ sendfile_iodone(void *arg, vm_page_t *pg, int coun
 	if (!refcount_release(&sfio->nios))
 		return;
 
-	so = sfio->sock_fp->f_data;
-
 	if (sfio->error) {
 		struct mbuf *m;
 
@@ -296,8 +294,9 @@ sendfile_iodone(void *arg, vm_page_t *pg, int coun
 		CURVNET_RESTORE();
 	}
 
-	/* XXXGL: curthread */
-	fdrop(sfio->sock_fp, curthread);
+	ACCEPT_LOCK();
+	SOCK_LOCK(so);
+	sorele(so);
 	free(sfio, M_TEMP);
 }
 
@@ -858,9 +857,11 @@ prepend_header:
 			error = (*so->so_proto->pr_usrreqs->pru_send)
 			    (so, 0, m, NULL, NULL, td);
 		} else {
-			sfio->sock_fp = sock_fp;
+			sfio->so = so;
 			sfio->npages = npages;
-			fhold(sock_fp);
+			SOCK_LOCK(so);
+			soref(so);
+			SOCK_UNLOCK(so);
 			error = (*so->so_proto->pr_usrreqs->pru_send)
 			    (so, PRUS_NOTREADY, m, NULL, NULL, td);
 			sendfile_iodone(sfio, NULL, 0, 0);