Index: sys/netinet/tcp_input.c
===================================================================
--- sys/netinet/tcp_input.c
+++ sys/netinet/tcp_input.c
@@ -3007,15 +3007,16 @@
 				tp->t_flags |= TF_DELACK;
 			else
 				tp->t_flags |= TF_ACKNOW;
-			tp->rcv_nxt += tlen;
-			thflags = th->th_flags & TH_FIN;
 			TCPSTAT_INC(tcps_rcvpack);
 			TCPSTAT_ADD(tcps_rcvbyte, tlen);
 			SOCKBUF_LOCK(&so->so_rcv);
-			if (so->so_rcv.sb_state & SBS_CANTRCVMORE)
+			if (so->so_rcv.sb_state & SBS_CANTRCVMORE) {
 				m_freem(m);
-			else
+				tlen = 0;
+			} else
 				sbappendstream_locked(&so->so_rcv, m, 0);
+			tp->rcv_nxt += tlen;
+			thflags = th->th_flags & TH_FIN;
 			/* NB: sorwakeup_locked() does an implicit unlock. */
 			sorwakeup_locked(so);
 		} else {