diff --git a/sys/netgraph7/lmi/ng_lmi.c b/sys/netgraph7/lmi/ng_lmi.c
--- a/sys/netgraph7/lmi/ng_lmi.c
+++ b/sys/netgraph7/lmi/ng_lmi.c
@@ -1055,6 +1055,19 @@
 {
 	const sc_p sc = NG_NODE_PRIVATE(node);
 
+	/*
+	 * Stop the LMI_ticker callout BEFORE tearing down sc. The original
+	 * code freed sc with the callout still armed, so the next ticker
+	 * firing would dereference NG_NODE_PRIVATE(node) (now NULL) or
+	 * freed memory. Use ng_uncallout (callout_stop, non-sync) followed
+	 * by callout_drain so we also wait for any currently-running
+	 * invocation of LMI_ticker to finish before sc is kfree()d.
+	 */
+	if (sc->flags & SCF_CONNECTED) {
+		ng_uncallout(&sc->handle, sc->node);
+		callout_drain(&sc->handle);
+	}
+
 	NG_NODE_SET_PRIVATE(node, NULL);
 	NG_NODE_UNREF(sc->node);
 	kfree(sc, M_NETGRAPH);