diff --git a/sys/net/if_ovpn.c b/sys/net/if_ovpn.c
--- a/sys/net/if_ovpn.c
+++ b/sys/net/if_ovpn.c
@@ -410,6 +410,8 @@
 {
 	struct ovpn_softc *sc;
 
+	CURVNET_ASSERT_SET();
+
 	atomic_add_int(&peer->refcount, -1);
 
 	if (atomic_load_int(&peer->refcount) > 0)
@@ -427,6 +429,8 @@
 		}
 	}
 
+	OVPN_ASSERT(sc);
+
 	/* The peer should have been removed from the list already. */
 	MPASS(ovpn_find_peer(sc, peer->peerid) == NULL);
 
@@ -633,6 +637,7 @@
 	int i;
 
 	OVPN_WASSERT(sc);
+	CURVNET_ASSERT_SET();
 
 	for (i = 0; i < OVPN_MAX_PEERS; i++) {
 		if (sc->peers[i] == NULL)
@@ -1441,17 +1446,19 @@
 	int tunnel_len;
 	int ret;
 
+	CURVNET_SET(sc->ifp->if_vnet);
+	NET_EPOCH_ENTER(et);
+
 	if (crp->crp_etype != 0) {
 		crypto_freereq(crp);
 		ovpn_peer_release_ref(peer, false);
+		NET_EPOCH_EXIT(et);
+		CURVNET_RESTORE();
 		OVPN_COUNTER_ADD(sc, lost_data_pkts_out, 1);
 		m_freem(m);
 		return (0);
 	}
 
-	NET_EPOCH_ENTER(et);
-	CURVNET_SET(sc->ifp->if_vnet);
-
 	MPASS(crp->crp_buf.cb_type == CRYPTO_BUF_MBUF);
 
 	tunnel_len = m->m_pkthdr.len - sizeof(struct ovpn_wire_header);
@@ -1461,12 +1468,12 @@
 		OVPN_COUNTER_ADD(sc, tunnel_bytes_sent, tunnel_len);
 	}
 
-	CURVNET_RESTORE();
-	NET_EPOCH_EXIT(et);
-
 	crypto_freereq(crp);
 	ovpn_peer_release_ref(peer, false);
 
+	NET_EPOCH_EXIT(et);
+	CURVNET_RESTORE();
+
 	return (0);
 }