While preparing the fix, I noticed an additional couple of oddities. First, files under sys/cam/scsi are inconsistent as to the order of calling cam_periph_release() and cam_periph_unlock(): Some of them will call cam_periph_release() first, and the others will call it second. Then, there's a number of places in the code where cam_periph_unlock() won't be called before return on a cam_periph_acquire() error, though the "periph" has been locked.