diff --git a/sys/net/ipfw3_basic/ip_fw3_sync.c b/sys/net/ipfw3_basic/ip_fw3_sync.c
--- a/sys/net/ipfw3_basic/ip_fw3_sync.c
+++ b/sys/net/ipfw3_basic/ip_fw3_sync.c
@@ -223,6 +223,11 @@
 		} else {
 			kprintf("Error ignore\n");
 		}
+		/* DF-0703: soreceive hands us an mbuf chain in sio.sb_mb; the next loop
+		   iteration's sbinit() zeroes sio.sb_mb without freeing it, so every
+		   received datagram leaks one mbuf chain forever. Free it here. */
+		if (m != NULL)
+			m_freem(m);
 	}
 	soshutdown(fw3_sync_ctx.edge_sock, SHUT_RD);
 	sofree(fw3_sync_ctx.edge_sock);