The lock is acquired from endpoint before calling send_tunnel multiple times.  Perhaps not the prettiest piece of code, but we do need that lock.