Index: sys/kern/kern_mbuf.c
===================================================================
--- sys/kern/kern_mbuf.c
+++ sys/kern/kern_mbuf.c
@@ -1650,11 +1650,16 @@
 struct ifnet *
 m_rcvif_restore(struct mbuf *m)
 {
+	struct ifnet *ifp;
 
 	M_ASSERTPKTHDR(m);
+	NET_EPOCH_ASSERT();
+
+	ifp = ifnet_byindexgen(m->m_pkthdr.rcvidx, m->m_pkthdr.rcvgen);
+	if (ifp == NULL || (ifp->if_flags & IFF_DYING))
+		return (NULL);
 
-	return ((m->m_pkthdr.rcvif = ifnet_byindexgen(m->m_pkthdr.rcvidx,
-	    m->m_pkthdr.rcvgen)));
+	return (m->m_pkthdr.rcvif = ifp);
 }
 
 /*
Index: sys/netpfil/ipfw/dn_sched_wf2q.c
===================================================================
--- sys/netpfil/ipfw/dn_sched_wf2q.c
+++ sys/netpfil/ipfw/dn_sched_wf2q.c
@@ -243,6 +243,8 @@
 	q = HEAP_TOP(sch)->object;
 	alg_fq = (struct wf2qp_queue *)q;
 	m = dn_dequeue(q);
+	if (m == NULL)
+		return NULL;
 	heap_extract(sch, NULL); /* Remove queue from heap. */
 	si->V += (uint64_t)(m->m_pkthdr.len) * si->inv_wsum;
 	alg_fq->S = alg_fq->F;  /* Update start time. */