diff --git a/sys/netipsec/key.c b/sys/netipsec/key.c
--- a/sys/netipsec/key.c
+++ b/sys/netipsec/key.c
@@ -1357,6 +1357,7 @@
 	struct secasvar *sav = *psav;
 
 	IPSEC_ASSERT(sav != NULL, ("null sav"));
+	CURVNET_ASSERT_SET();
 	if (SAV_DELREF(sav) == 0)
 		return;
 
@@ -1380,6 +1381,7 @@
 	KEYDBG(KEY_STAMP,
 	    printf("%s: SA(%p)\n", __func__, sav));
 
+	CURVNET_ASSERT_SET();
 	SAHTREE_UNLOCK_ASSERT();
 	SAHTREE_WLOCK();
 	if (sav->state == SADB_SASTATE_DEAD) {
@@ -2890,6 +2892,8 @@
 {
 	struct secashead *sah = *psah;
 
+	CURVNET_ASSERT_SET();
+
 	if (SAH_DELREF(sah) == 0)
 		return;