diff --git a/sys/netpfil/ipfilter/netinet/ip_nat.c b/sys/netpfil/ipfilter/netinet/ip_nat.c
--- a/sys/netpfil/ipfilter/netinet/ip_nat.c
+++ b/sys/netpfil/ipfilter/netinet/ip_nat.c
@@ -1767,6 +1767,7 @@
 	}
 
 	KMALLOCS(ipn, nat_save_t *, ipns.ipn_dsize);
+	bzero(ipn, ipns.ipn_dsize);
 	if (ipn == NULL) {
 		IPFERROR(60029);
 		return (ENOMEM);