diff --git a/sys/net/pf/pf_norm.c b/sys/net/pf/pf_norm.c
--- a/sys/net/pf/pf_norm.c
+++ b/sys/net/pf/pf_norm.c
@@ -660,10 +660,15 @@
 				 */
 				*m0 = m_dup(m, M_NOWAIT);
 				/* From KAME Project : We have missed this! */
-				m_adj(*m0, (h->ip_hl << 2) -
-				    (*m0)->m_pkthdr.len);
+				/* DF-0391: the NULL check must precede the
+				 * m_adj() argument expression, which otherwise
+				 * evaluates (*m0)->m_pkthdr.len -- a NULL
+				 * dereference -- before the guard on the old
+				 * next line. */
 				if (*m0 == NULL)
 					goto no_mem;
+				m_adj(*m0, (h->ip_hl << 2) -
+				    (*m0)->m_pkthdr.len);
 				KASSERT(((*m0)->m_next == NULL),
 				    ("(*m0)->m_next != NULL: %s",
 				    __func__));