diff --git a/sys/netipsec/xform_esp.c b/sys/netipsec/xform_esp.c
--- a/sys/netipsec/xform_esp.c
+++ b/sys/netipsec/xform_esp.c
@@ -657,7 +657,6 @@
 	CURVNET_RESTORE();
 	return error;
 bad:
-	CURVNET_RESTORE();
 	if (sav != NULL)
 		key_freesav(&sav);
 	if (m != NULL)
@@ -668,6 +667,7 @@
 		free(crp->crp_aad, M_ESP);
 		crypto_freereq(crp);
 	}
+	CURVNET_RESTORE();
 	return error;
 }
 /*
@@ -1043,12 +1043,12 @@
 	CURVNET_RESTORE();
 	return (error);
 bad:
-	CURVNET_RESTORE();
 	free(xd, M_ESP);
 	free(crp->crp_aad, M_ESP);
 	crypto_freereq(crp);
 	key_freesav(&sav);
 	key_freesp(&sp);
+	CURVNET_RESTORE();
 	return (error);
 }