diff --git a/sys/netgraph7/one2many/ng_one2many.c b/sys/netgraph7/one2many/ng_one2many.c
--- a/sys/netgraph7/one2many/ng_one2many.c
+++ b/sys/netgraph7/one2many/ng_one2many.c
@@ -464,8 +464,14 @@
 				m2 = m_dup(m, M_NOWAIT);        /* XXX m_copypacket() */
 				if (m2 == NULL) {
 					mdst->stats.memoryFailures++;
+					/* Detach the mbuf from the item before freeing it.
+					 * Without this, NG_FREE_ITEM() leaves _NGI_M(item)
+					 * dangling at the just-freed mbuf, and ng_apply_item()'s
+					 * ng_free_item() (NGQF_DATA case) frees _NGI_M again =>
+					 * double-free / use-after-free (confirmed via harness). */
+					NGI_GET_M(item, m);	/* m = _NGI_M(item); _NGI_M(item) = NULL */
 					NG_FREE_ITEM(item);
-					NG_FREE_M(m);
+					NG_FREE_M(m);		/* freed exactly once */
 					return (ENOBUFS);
 				}
 				/* Update transmit stats */