diff --git a/sys/net/pfvar.h b/sys/net/pfvar.h
--- a/sys/net/pfvar.h
+++ b/sys/net/pfvar.h
@@ -1704,7 +1704,7 @@
 struct pfioc_states {
 	int	ps_len;
 	union {
-		caddr_t			 ps_buf;
+		void			*ps_buf;
 		struct pfsync_state	*ps_states;
 	};
 };
@@ -1713,7 +1713,7 @@
 	int		ps_len;
 	uint64_t	ps_req_version;
 	union {
-		caddr_t			 ps_buf;
+		void			*ps_buf;
 		struct pf_state_export	*ps_states;
 	};
 };
@@ -1721,7 +1721,7 @@
 struct pfioc_src_nodes {
 	int	psn_len;
 	union {
-		caddr_t		 psn_buf;
+		void		*psn_buf;
 		struct pf_src_node	*psn_src_nodes;
 	};
 };
diff --git a/sys/netpfil/pf/pf_ioctl.c b/sys/netpfil/pf/pf_ioctl.c
--- a/sys/netpfil/pf/pf_ioctl.c
+++ b/sys/netpfil/pf/pf_ioctl.c
@@ -1447,8 +1447,8 @@
 
 		if (rs->rules[rs_cnt].inactive.rcount) {
 			rs->rules[rs_cnt].inactive.ptr_array =
-			    malloc(sizeof(caddr_t) *
-			    rs->rules[rs_cnt].inactive.rcount,
+			    mallocarray(rs->rules[rs_cnt].inactive.rcount,
+			    sizeof(struct pf_rule **),
 			    M_TEMP, M_NOWAIT);
 
 			if (!rs->rules[rs_cnt].inactive.ptr_array)
diff --git a/sys/netpfil/pf/pf_norm.c b/sys/netpfil/pf/pf_norm.c
--- a/sys/netpfil/pf/pf_norm.c
+++ b/sys/netpfil/pf/pf_norm.c
@@ -883,7 +883,7 @@
 	/* Take protocol from first fragment header. */
 	m = m_getptr(m, hdrlen + offsetof(struct ip6_frag, ip6f_nxt), &off);
 	KASSERT(m, ("%s: short mbuf chain", __func__));
-	proto = *(mtod(m, caddr_t) + off);
+	proto = *(mtod(m, uint8_t *) + off);
 	m = *m0;
 
 	/* Delete frag6 header */
@@ -967,7 +967,7 @@
 		m = m_getptr(m, extoff + offsetof(struct ip6_ext, ip6e_nxt),
 		    &off);
 		KASSERT((m != NULL), ("pf_refragment6: short mbuf chain"));
-		proto = *(mtod(m, caddr_t) + off);
+		proto = *(mtod(m, uint8_t *) + off);
 		*(mtod(m, char *) + off) = IPPROTO_FRAGMENT;
 		m = *m0;
 	} else {