diff --git a/sys/net/pf/pf_ioctl.c b/sys/net/pf/pf_ioctl.c
--- a/sys/net/pf/pf_ioctl.c
+++ b/sys/net/pf/pf_ioctl.c
@@ -2166,7 +2166,10 @@
 		if (pa->ifname[0]) {
 			pa->kif = pfi_kif_get(pa->ifname);
 			if (pa->kif == NULL) {
-				kfree(ap, M_PFPOOLADDRPL);
+				/* DF-0276: was kfree(ap,...) which freed the framework's
+				 * dev_ioctl_args pointer (stack) instead of the
+				 * allocated pa. */
+				kfree(pa, M_PFPOOLADDRPL);
 				error = EINVAL;
 				break;
 			}