diff --git a/sys/netinet/tcp_syncache.c b/sys/netinet/tcp_syncache.c
--- a/sys/netinet/tcp_syncache.c
+++ b/sys/netinet/tcp_syncache.c
@@ -1548,6 +1548,8 @@
 		 */
 		mac_syncache_destroy(&maclabel);
 #endif
+		if (cred != NULL)
+			crfree(cred);
 		TCP_PROBE5(receive, NULL, NULL, m, NULL, th);
 		/* Retransmit SYN|ACK and reset retransmit count. */
 		if ((s = tcp_log_addrs(&sc->sc_inc, th, NULL, NULL))) {
@@ -1625,7 +1627,6 @@
 #endif
 	sc->sc_cred = cred;
 	sc->sc_port = port;
-	cred = NULL;
 	sc->sc_ipopts = ipopts;
 	bcopy(inc, &sc->sc_inc, sizeof(struct in_conninfo));
 	sc->sc_ip_tos = ip_tos;
@@ -1761,9 +1762,9 @@
 		tcp_fastopen_decrement_counter(tfo_pending);
 
 tfo_expanded:
-	if (cred != NULL)
-		crfree(cred);
 	if (sc == NULL || sc == &scs) {
+		if (cred != NULL)
+			crfree(cred);
 #ifdef MAC
 		mac_syncache_destroy(&maclabel);
 #endif