diff --git a/sys/netpfil/pf/if_pfsync.c b/sys/netpfil/pf/if_pfsync.c
--- a/sys/netpfil/pf/if_pfsync.c
+++ b/sys/netpfil/pf/if_pfsync.c
@@ -402,7 +402,7 @@
 {
 	struct pfsync_softc *sc = ifp->if_softc;
 	struct pfsync_bucket *b;
-	int c;
+	int c, ret;
 
 	for (c = 0; c < pfsync_buckets; c++) {
 		b = &sc->sc_buckets[c];
@@ -416,16 +416,18 @@
 			    TAILQ_FIRST(&b->b_deferrals);
 
 			TAILQ_REMOVE(&b->b_deferrals, pd, pd_entry);
+			PFSYNC_BUCKET_LOCK(b);
 			b->b_deferred--;
-			if (callout_stop(&pd->pd_tmo) > 0) {
+			ret = callout_stop(&pd->pd_tmo);
+			PFSYNC_BUCKET_UNLOCK(b);
+			if (ret > 0) {
 				pf_release_state(pd->pd_st);
 				m_freem(pd->pd_m);
-				free(pd, M_PFSYNC);
 			} else {
 				pd->pd_refs++;
 				callout_drain(&pd->pd_tmo);
-				free(pd, M_PFSYNC);
 			}
+			free(pd, M_PFSYNC);
 		}
 
 		callout_drain(&b->b_tmo);