Index: kern/kern_mbuf.c
===================================================================
--- kern/kern_mbuf.c
+++ kern/kern_mbuf.c
@@ -813,6 +813,13 @@
 				(*pr->pr_drain)();
 }
 
+void
+mb_reclaim_from_all_domains(void)
+{
+
+	mb_reclaim(NULL, 0);
+}
+
 /*
  * Clean up after mbufs with M_EXT storage attached to them if the
  * reference count hits 1.
Index: net/if.c
===================================================================
--- net/if.c
+++ net/if.c
@@ -1206,6 +1206,13 @@
 finish_vnet_shutdown:
 #endif
 	/*
+	 * Make sure all re-assembly mbufs get freed. This prevents
+	 * references to our network interface structure after detach
+	 * through mb->rcvif .
+	 */
+	mb_reclaim_from_all_domains();
+
+	/*
 	 * We cannot hold the lock over dom_ifdetach calls as they might
 	 * sleep, for example trying to drain a callout, thus open up the
 	 * theoretical race with re-attaching.
Index: sys/mbuf.h
===================================================================
--- sys/mbuf.h
+++ sys/mbuf.h
@@ -615,6 +615,7 @@
 
 void		 mb_dupcl(struct mbuf *, struct mbuf *);
 void		 mb_free_ext(struct mbuf *);
+void		 mb_reclaim_from_all_domains(void);
 void		 m_adj(struct mbuf *, int);
 int		 m_apply(struct mbuf *, int, int,
 		    int (*)(void *, void *, u_int), void *);