diff --git a/sys/cam/scsi/scsi_xpt.c b/sys/cam/scsi/scsi_xpt.c
--- a/sys/cam/scsi/scsi_xpt.c
+++ b/sys/cam/scsi/scsi_xpt.c
@@ -2034,9 +2034,17 @@
 				printf(
 		"scsi_scan_bus: xpt_create_path failed with status %#x, bus scan halted\n",
 				    status);
+				/*
+				 * Note: work_ccb from above was scan_info->cpi
+				 * before this loop, but then becomes the CCB
+				 * we've queued for the scan, so we have to free
+				 * it when freeing scan_info. work_ccb, when not
+				 * the same as scan_info->cpi gets freed when
+				 * that work is complete.
+				 */
+				xpt_free_ccb((union ccb *)scan_info->cpi);
 				free(scan_info, M_CAMXPT);
 				request_ccb->ccb_h.status = status;
-				xpt_free_ccb(work_ccb);
 				xpt_done(request_ccb);
 				break;
 			}