diff --git a/sys/dev/if_wg/module/if_wg_session.c b/sys/dev/if_wg/module/if_wg_session.c
--- a/sys/dev/if_wg/module/if_wg_session.c
+++ b/sys/dev/if_wg/module/if_wg_session.c
@@ -1913,6 +1913,7 @@
 	 */
 	if ((m = m_pullup(m0, m0->m_pkthdr.len)) == NULL) {
 		DPRINTF(sc, "DEFRAG fail\n");
+		m_freem(m0);
 		return;
 	}
 	data = mtod(m, void *);
@@ -1943,8 +1944,10 @@
 		verify_endpoint(m);
 		if (mbufq_enqueue(&sc->sc_handshake_queue, m) == 0) {
 			GROUPTASK_ENQUEUE(&sc->sc_handshake);
-		} else
+		} else {
 			DPRINTF(sc, "Dropping handshake packet\n");
+			wg_m_freem(m);
+		}
 	} else if (pktlen >= sizeof(struct wg_pkt_data) + NOISE_MAC_SIZE
 	    && pkttype == MESSAGE_DATA) {