diff --git a/sys/opencrypto/crypto.c b/sys/opencrypto/crypto.c
--- a/sys/opencrypto/crypto.c
+++ b/sys/opencrypto/crypto.c
@@ -1289,6 +1289,18 @@
 		    ("incoming crp with separate output buffer "
 		    "but no session support"));
 
+	if (CRYPTO_HAS_OUTPUT_BUFFER(crp)) {
+		if (crp->crp_obuf.cb_type == CRYPTO_BUF_MBUF ||
+		    crp->crp_obuf.cb_type == CRYPTO_BUF_SINGLE_MBUF) {
+			MPASS(M_WRITABLE(crp->crp_obuf.cb_mbuf));
+		}
+	} else {
+		if (crp->crp_buf.cb_type == CRYPTO_BUF_MBUF ||
+		    crp->crp_buf.cb_type == CRYPTO_BUF_SINGLE_MBUF) {
+			MPASS(M_WRITABLE(crp->crp_buf.cb_mbuf));
+		}
+	}
+
 	switch (csp->csp_mode) {
 	case CSP_MODE_COMPRESS:
 		KASSERT(crp->crp_op == CRYPTO_OP_COMPRESS ||