When reusing tcp_do_segment() to set up passive peer sockets, I
completely overlooked its lock-releasing behavior.  This is the
practical near-term solution that Adrian and I worked out and that
Adrian authored.  Ideally, the operative bits of interest to the
passive peer construction code could be factored out of
tcp_do_segment().