Why not strcmp(ifp->if_dname, "lagg") ?

That's a certainly a generic function that is needed.

Can we leave the vlan/lagg implementation logic inside appropriate modules and avoid polluting if.c?
For example, can we hide the appropriate chunks into function like vlan_get_parent(ifp) and lagg_is_parent_of(ifp) with these functions residing in if_vlan.c and if_lagg.c?

Typo: inerface

Same here:
Can this be something like vlan_get_parent(ifp) and lagg_get_active_trunk(ifp) residing in if_vlan.c? if_lagg.c?

Maybe it would help the other potential consumers of this eventhandler if events could be further split into LAGG_PORT_<UP|DOWN|CHANGE>

Because the function is recursive, I think an all-in-one approach is more readable.