Ah, OK. I'd thought we started unlocked, but given that I've just been disassembling the kernel and looking at the lock prefixes, that's a bit of a braino on my part.
BTW, using the ds prefix allows us to undo the hack of dealing with locked instructions with exception handlers. There was a bug where if we do lock->nop, then the address of a faulting instruction changes, so we need exception records for both the locked and unlocked forms. Using ds means the instruction size doesn't change, so we only need one exception record. I don't remember off hand where that happens.