Index: head/sys/netinet/in_pcb.h
===================================================================
--- head/sys/netinet/in_pcb.h
+++ head/sys/netinet/in_pcb.h
@@ -884,7 +884,7 @@
 int	in_pcbattach_txrtlmt(struct inpcb *, struct ifnet *, uint32_t, uint32_t,
 	    uint32_t, struct m_snd_tag **);
 void	in_pcbdetach_txrtlmt(struct inpcb *);
-void    in_pcbdetach_tag(struct ifnet *ifp, struct m_snd_tag *mst);
+void    in_pcbdetach_tag(struct m_snd_tag *);
 int	in_pcbmodify_txrtlmt(struct inpcb *, uint32_t);
 int	in_pcbquery_txrtlmt(struct inpcb *, uint32_t *);
 int	in_pcbquery_txrlevel(struct inpcb *, uint32_t *);
Index: head/sys/netinet/in_pcb.c
===================================================================
--- head/sys/netinet/in_pcb.c
+++ head/sys/netinet/in_pcb.c
@@ -3347,20 +3347,10 @@
 }
 
 void
-in_pcbdetach_tag(struct ifnet *ifp, struct m_snd_tag *mst)
+in_pcbdetach_tag(struct m_snd_tag *mst)
 {
-	if (ifp == NULL)
-		return;
 
-	/*
-	 * If the device was detached while we still had reference(s)
-	 * on the ifp, we assume if_snd_tag_free() was replaced with
-	 * stubs.
-	 */
-	ifp->if_snd_tag_free(mst);
-
-	/* release reference count on network interface */
-	if_rele(ifp);
+	m_snd_tag_rele(mst);
 #ifdef INET
 	counter_u64_add(rate_limit_active, -1);
 #endif
Index: head/sys/netinet/tcp_ratelimit.c
===================================================================
--- head/sys/netinet/tcp_ratelimit.c
+++ head/sys/netinet/tcp_ratelimit.c
@@ -1028,7 +1028,7 @@
 		return (NULL);
 	}
 	tifp = tag->ifp;
-	tifp->if_snd_tag_free(tag);
+	m_snd_tag_rele(tag);
 	return (tifp);
 }
 
@@ -1161,7 +1161,6 @@
 tcp_rl_ifnet_departure(void *arg __unused, struct ifnet *ifp)
 {
 	struct tcp_rate_set *rs, *nrs;
-	struct ifnet *tifp;
 	int i;
 
 	mtx_lock(&rs_mtx);
@@ -1173,8 +1172,7 @@
 			rs->rs_flags |= RS_IS_DEAD;
 			for (i = 0; i < rs->rs_rate_cnt; i++) {
 				if (rs->rs_rlt[i].flags & HDWRPACE_TAGPRESENT) {
-					tifp = rs->rs_rlt[i].tag->ifp;
-					in_pcbdetach_tag(tifp, rs->rs_rlt[i].tag);
+					in_pcbdetach_tag(rs->rs_rlt[i].tag);
 					rs->rs_rlt[i].tag = NULL;
 				}
 				rs->rs_rlt[i].flags = HDWRPACE_IFPDEPARTED;
@@ -1191,7 +1189,6 @@
 tcp_rl_shutdown(void *arg __unused, int howto __unused)
 {
 	struct tcp_rate_set *rs, *nrs;
-	struct ifnet *tifp;
 	int i;
 
 	mtx_lock(&rs_mtx);
@@ -1201,8 +1198,7 @@
 		rs->rs_flags |= RS_IS_DEAD;
 		for (i = 0; i < rs->rs_rate_cnt; i++) {
 			if (rs->rs_rlt[i].flags & HDWRPACE_TAGPRESENT) {
-				tifp = rs->rs_rlt[i].tag->ifp;
-				in_pcbdetach_tag(tifp, rs->rs_rlt[i].tag);
+				in_pcbdetach_tag(rs->rs_rlt[i].tag);
 				rs->rs_rlt[i].tag = NULL;
 			}
 			rs->rs_rlt[i].flags = HDWRPACE_IFPDEPARTED;