diff --git a/sys/netipsec/ipsec_output.c b/sys/netipsec/ipsec_output.c
--- a/sys/netipsec/ipsec_output.c
+++ b/sys/netipsec/ipsec_output.c
@@ -323,13 +323,26 @@
 		 * this is done in the normal processing path.
 		 */
 		if (m->m_pkthdr.csum_flags & CSUM_DELAY_DATA) {
+			m = mb_unmapped_to_ext(m);
+			if (m == NULL) {
+				IPSECSTAT_INC(ips_out_nomem);
+				key_freesp(&sp);
+				return (ENOBUFS);
+			}
 			in_delayed_cksum(m);
 			m->m_pkthdr.csum_flags &= ~CSUM_DELAY_DATA;
 		}
 #if defined(SCTP) || defined(SCTP_SUPPORT)
 		if (m->m_pkthdr.csum_flags & CSUM_SCTP) {
-			struct ip *ip = mtod(m, struct ip *);
+			struct ip *ip;
 
+			m = mb_unmapped_to_ext(m);
+			if (m == NULL) {
+				IPSECSTAT_INC(ips_out_nomem);
+				key_freesp(&sp);
+				return (ENOBUFS);
+			}
+			ip = mtod(m, struct ip *);
 			sctp_delayed_cksum(m, (uint32_t)(ip->ip_hl << 2));
 			m->m_pkthdr.csum_flags &= ~CSUM_SCTP;
 		}
@@ -617,12 +630,24 @@
 		 * this is done in the normal processing path.
 		 */
 		if (m->m_pkthdr.csum_flags & CSUM_DELAY_DATA_IPV6) {
+			m = mb_unmapped_to_ext(m);
+			if (m == NULL) {
+				IPSEC6STAT_INC(ips_out_nomem);
+				key_freesp(&sp);
+				return (ENOBUFS);
+			}
 			in6_delayed_cksum(m, m->m_pkthdr.len -
 			    sizeof(struct ip6_hdr), sizeof(struct ip6_hdr));
-		m->m_pkthdr.csum_flags &= ~CSUM_DELAY_DATA_IPV6;
+			m->m_pkthdr.csum_flags &= ~CSUM_DELAY_DATA_IPV6;
 		}
 #if defined(SCTP) || defined(SCTP_SUPPORT)
 		if (m->m_pkthdr.csum_flags & CSUM_SCTP_IPV6) {
+			m = mb_unmapped_to_ext(m);
+			if (m == NULL) {
+				IPSEC6STAT_INC(ips_out_nomem);
+				key_freesp(&sp);
+				return (ENOBUFS);
+			}
 			sctp_delayed_cksum(m, sizeof(struct ip6_hdr));
 			m->m_pkthdr.csum_flags &= ~CSUM_SCTP_IPV6;
 		}