diff --git a/sys/netpfil/pf/pf.c b/sys/netpfil/pf/pf.c
--- a/sys/netpfil/pf/pf.c
+++ b/sys/netpfil/pf/pf.c
@@ -2730,15 +2730,19 @@
 	NET_EPOCH_ASSERT();
 	PF_HASHROW_ASSERT(ih);
 
+	PF_STATE_LOCK(s);
 	if (s->timeout == PFTM_UNLINKED) {
 		/*
 		 * State is being processed
 		 * by pf_unlink_state() in
 		 * an other thread.
 		 */
+		PF_STATE_UNLOCK(s);
 		PF_HASHROW_UNLOCK(ih);
 		return (0);	/* XXXGL: undefined actually */
 	}
+	s->timeout = PFTM_UNLINKED;
+	PF_STATE_UNLOCK(s);
 
 	if (s->src.state == PF_TCPS_PROXY_DST) {
 		/* XXX wire key the right one? */
@@ -2760,8 +2764,6 @@
 
 	STATE_DEC_COUNTERS(s);
 
-	s->timeout = PFTM_UNLINKED;
-
 	/* Ensure we remove it from the list of halfopen states, if needed. */
 	if (s->key[PF_SK_STACK] != NULL &&
 	    s->key[PF_SK_STACK]->proto == IPPROTO_TCP)