lock order reversal: (sleepable after non-sleepable) when rtw890 goes up

Hello all FreeBSD fellows!

After syncing 16.0-current source to recent, I started to receive these 
messages during WiFi (rtw890) startup:

lock order reversal: (sleepable after non-sleepable)
  1st 0xfffffe0147abb020 rtw890_com_lock (rtw890_com_lock, sleep mutex) @ 
/home/rz/FreeBSD-src/src-current/sys/net80211/ieee80211_ioctl.c:3711
  2nd 0xffffffff81e8ee48 ifnet_sx (ifnet_sx, sx) @ 
/home/rz/FreeBSD-src/src-current/sys/net/if.c:1485
lock order rtw890_com_lock -> ifnet_sx attempted at:
#0 0xffffffff80ccc8be at witness_checkorder+0xd3e
#1 0xffffffff80c61ca4 at _sx_slock_int+0x64
#2 0xffffffff80da1595 at if_foreach_group+0x35
#3 0xffffffff80effe8b at dump_iface+0xc3b
#4 0xffffffff80efeab6 at rtnl_handle_ifnet_event+0x96
#5 0xffffffff80e02a02 at ieee80211_notify_ifnet_change+0x62
#6 0xffffffff80e2fab2 at ieee80211_start_locked+0x72
#7 0xffffffff80e126d3 at ieee80211_ioctl+0x323
#8 0xffffffff80da3e2c at ifhwioctl+0xe1c
#9 0xffffffff80da5332 at ifioctl+0x702
#10 0xffffffff80cd3cdd at kern_ioctl+0x2bd
#11 0xffffffff80cd39bf at sys_ioctl+0x12f
#12 0xffffffff811f8a9d at amd64_syscall+0x17d
#13 0xffffffff811c479b at fast_syscall_common+0xf8
wlan0: link state changed to UP

Trying to bisect it I got to this commit:

commit 2f8f892ca344d884abbed0305886bb532f16368f
Author: Pouria Mousavizadeh Tehrani <pouria@FreeBSD.org>
Date:   Thu Aug 27 16:13:28 2026 +0330

It introduces new function if_foreach_group() which acquires sleepable 
sx lock while another non-sleepable lock already taken in 
ieee80211_ioctl().

Also, when tracing the above, I noticed that if_foreach_group() can be 
called from inside of epoch critical section in sys/net/if.c via 
if_foreach_sleep() where the former is provided as callback. Calling 
path is: if_foreach_sleep (epoch_enter_preempt) -> match_cb -> dump_cb 
-> dump_iface -> dump_group -> if_foreach_group(). Can this possibly be 
an issue ?

-- 
WBR, Ruslan.

PGP: D7545516DF544C4A, Get by finger rz@fabmicro.ru