Index: sys/kern/kern_fork.c
===================================================================
--- sys/kern/kern_fork.c
+++ sys/kern/kern_fork.c
@@ -370,7 +370,7 @@
     struct vmspace *vm2, int pdflags)
 {
 	struct proc *p1, *pptr;
-	int p2_held, trypid;
+	int trypid;
 	struct filedesc *fd;
 	struct filedesc_to_leader *fdtol;
 	struct sigacts *newsigacts;
@@ -378,7 +378,6 @@
 	sx_assert(&proctree_lock, SX_SLOCKED);
 	sx_assert(&allproc_lock, SX_XLOCKED);
 
-	p2_held = 0;
 	p1 = td->td_proc;
 
 	/*
@@ -723,13 +722,13 @@
 		 */
 		td->td_dbgflags |= TDB_FORK;
 		td->td_dbg_forked = p2->p_pid;
+		td->td_forked_td = td2;
 		td2->td_dbgflags |= TDB_STOPATFORK;
 		_PHOLD(p2);
-		p2_held = 1;
 	}
 	if (flags & RFPPWAIT) {
 		td->td_pflags |= TDP_RFPPWAIT;
-		td->td_rfppwait_p = p2;
+		td->td_forked_td = td2;
 	}
 	PROC_UNLOCK(p2);
 	if ((flags & RFSTOPPED) == 0) {
@@ -754,16 +753,6 @@
 	 */
 	knote_fork(&p1->p_klist, p2->p_pid);
 	SDT_PROBE3(proc, kernel, , create, p2, p1, flags);
-
-	/*
-	 * Wait until debugger is attached to child.
-	 */
-	PROC_LOCK(p2);
-	while ((td2->td_dbgflags & TDB_STOPATFORK) != 0)
-		cv_wait(&p2->p_dbgwait, &p2->p_mtx);
-	if (p2_held)
-		_PRELE(p2);
-	PROC_UNLOCK(p2);
 }
 
 int
Index: sys/kern/subr_syscall.c
===================================================================
--- sys/kern/subr_syscall.c
+++ sys/kern/subr_syscall.c
@@ -173,10 +173,24 @@
 syscallret(struct thread *td, int error, struct syscall_args *sa)
 {
 	struct proc *p, *p2;
+	struct thread *td2;
 	int traced;
 
 	p = td->td_proc;
 
+	if ((td->td_dbgflags & TDB_FORK) != 0) {
+		/*
+		 * Wait until debugger is attached to child.
+		 */
+		td2 = td->td_forked_td;
+		p2 = td2->td_proc;
+		PROC_LOCK(p2);
+		while ((td2->td_dbgflags & TDB_STOPATFORK) != 0)
+			cv_wait(&p2->p_dbgwait, &p2->p_mtx);
+		_PRELE(p2);
+		PROC_UNLOCK(p2);
+	}
+
 	/*
 	 * Handle reschedule and other end-of-syscall issues
 	 */
@@ -231,7 +245,7 @@
 		 * to finish vfork wait.
 		 */
 		td->td_pflags &= ~TDP_RFPPWAIT;
-		p2 = td->td_rfppwait_p;
+		p2 = td->td_forked_td->td_proc;
 again:
 		PROC_LOCK(p2);
 		while (p2->p_flag & P_PPWAIT) {
Index: sys/sys/proc.h
===================================================================
--- sys/sys/proc.h
+++ sys/sys/proc.h
@@ -331,7 +331,7 @@
 	struct vnet	*td_vnet;	/* (k) Effective vnet. */
 	const char	*td_vnet_lpush;	/* (k) Debugging vnet push / pop. */
 	struct trapframe *td_intr_frame;/* (k) Frame of the current irq */
-	struct proc	*td_rfppwait_p;	/* (k) The vforked child */
+	struct thread	*td_forked_td;	/* (k) The forked child */
 	struct vm_page	**td_ma;	/* (k) uio pages held */
 	int		td_ma_cnt;	/* (k) size of *td_ma */
 	void		*td_emuldata;	/* Emulator state data */