@rmacklem could you please file it as a PR in https://github.com/openzfs/zfs ?

I have tested the patch on a semi-production system with 30000 ifnet ktls sessions and 50Gbit/s traffic. Is it ok to go in?

Ok, so when I understand it correctly, in the linuxkpi the "struct mutex" is a shared/exclusive lock sx(9) and "struct mtx" is mutex for thread synchronization mutex(9).

In other source files of the mlx5 driver the same "mtx_assert" syntax is used to assert sx locks, I wanted to stay consistent. If you want I can replace it with sx_assert().

I have updated the patch with the assert.

Looks like we can already set "-rxtls" on network interfaces, it just isn't documented in ifconfig manual page.
So I am withdrawing this revision - the workaround is to disable rxtls.