diff --git a/sys/netinet/ip_output.c b/sys/netinet/ip_output.c
--- a/sys/netinet/ip_output.c
+++ b/sys/netinet/ip_output.c
@@ -947,6 +947,13 @@
 		 * in the existing chain instead of rearranging it.
 		 */
 		m = m_pullup(m, offset + sizeof(u_short));
+		/* DF-0406: m_pullup may fail (returns NULL) under memory
+		 * pressure; the unchecked return caused the assignment on
+		 * the next line to dereference NULL+offset.  Free the chain
+		 * and bail out -- a dropped packet is correct, a kernel
+		 * panic is not. */
+		if (m == NULL)
+			return;
 	}
 	*(u_short *)(m->m_data + offset) = csum;
 }