diff --git a/sys/opencrypto/crypto.c b/sys/opencrypto/crypto.c
--- a/sys/opencrypto/crypto.c
+++ b/sys/opencrypto/crypto.c
@@ -1527,6 +1527,7 @@
 static int
 crypto_invoke(struct cryptocap *cap, struct cryptop *crp, int hint)
 {
+	int error;
 
 	KASSERT(crp != NULL, ("%s: crp == NULL", __func__));
 	KASSERT(crp->crp_callback != NULL,
@@ -1575,13 +1576,19 @@
 
 		crp->crp_etype = EAGAIN;
 		crypto_done(crp);
-		return 0;
+		error = 0;
 	} else {
 		/*
-		 * Invoke the driver to process the request.
+		 * Invoke the driver to process the request.  Errors are
+		 * signaled by setting crp_etype before invoking the completion
+		 * callback.
 		 */
-		return CRYPTODEV_PROCESS(cap->cc_dev, crp, hint);
+		error = CRYPTODEV_PROCESS(cap->cc_dev, crp, hint);
+		KASSERT(error == 0 || error == ERESTART,
+		    ("%s: invalid error %d from CRYPTODEV_PROCESS",
+		    __func__, error));
 	}
+	return (error);
 }
 
 void