Index: sys/netgraph/ng_base.c
===================================================================
--- sys/netgraph/ng_base.c
+++ sys/netgraph/ng_base.c
@@ -3814,7 +3814,7 @@
 	rval = callout_stop(c);
 	item = c->c_arg;
 	/* Do an extra check */
-	if ((rval > 0) && (c->c_func == &ng_callout_trampoline) &&
+	if (item && (rval > 0) && (c->c_func == &ng_callout_trampoline) &&
 	    (NGI_NODE(item) == node)) {
 		/*
 		 * We successfully removed it from the queue before it ran