diff --git a/sys/net/netmap/netmap_mem2.c b/sys/net/netmap/netmap_mem2.c
--- a/sys/net/netmap/netmap_mem2.c
+++ b/sys/net/netmap/netmap_mem2.c
@@ -332,6 +332,20 @@
 		D("invalid index %u, max %u", j, p->objtotal);
 		return;
 	}
+	/*
+	 * Defense-in-depth against DF-0547: detect double-free / wrong-ring
+	 * free attempts. The shared-memory ring->slot[i].buf_idx is writable
+	 * by userspace; without per-ring ownership tracking, a malicious user
+	 * can rewrite it to point at a buffer owned by another adapter
+	 * sharing this nm_mem, causing us to free a buffer that doesn't
+	 * belong to this ring. Catch the most common cases here:
+	 *   - bit already set => double-free (or already freed by another
+	 *     ring's teardown). Log and skip; do NOT bump objfree.
+	 */
+	if (p->bitmap[j / 32] & (1 << (j % 32))) {
+		D("buf %u already free (double-free or cross-ring free?)", j);
+		return;
+	}
 	p->bitmap[j / 32] |= (1 << (j % 32));
 	p->objfree++;
 	return;