Index: sys/netinet/tcp_fastopen.c
===================================================================
--- sys/netinet/tcp_fastopen.c
+++ sys/netinet/tcp_fastopen.c
@@ -204,7 +204,7 @@
 tcp_fastopen_init(void)
 {
        V_counter_zone = uma_zcreate("tfo", sizeof(unsigned int),
-           NULL, NULL, NULL, NULL, UMA_ALIGN_PTR, UMA_ZONE_NOFREE);
+           NULL, NULL, NULL, NULL, UMA_ALIGN_PTR, 0);
        rm_init(&V_tcp_fastopen_keylock, "tfo_keylock");
        callout_init_rm(&V_tcp_fastopen_autokey_ctx.c,
            &V_tcp_fastopen_keylock, 0);
Index: sys/netinet/tcp_subr.c
===================================================================
--- sys/netinet/tcp_subr.c
+++ sys/netinet/tcp_subr.c
@@ -738,9 +738,6 @@
 {
        int error;

-#ifdef TCP_RFC7413
-       tcp_fastopen_destroy();
-#endif
        tcp_hc_destroy();
        syncache_destroy();
        tcp_tw_destroy();
@@ -748,6 +745,14 @@
        uma_zdestroy(V_sack_hole_zone);
        uma_zdestroy(V_tcpcb_zone);

+#ifdef TCP_RFC7413
+       /*
+        * Cannot free the zone until all tcpcbs are released as we attach
+        * the allocations to them.
+        */
+       tcp_fastopen_destroy();
+#endif
+
        error = hhook_head_deregister(V_tcp_hhh[HHOOK_TCP_EST_IN]);
        if (error != 0) {
                printf("%s: WARNING: unable to deregister helper hook "