diff --git a/sys/vfs/hammer2/zlib/hammer2_zlib_inflate.c b/sys/vfs/hammer2/zlib/hammer2_zlib_inflate.c
--- a/sys/vfs/hammer2/zlib/hammer2_zlib_inflate.c
+++ b/sys/vfs/hammer2/zlib/hammer2_zlib_inflate.c
@@ -377,6 +377,18 @@
         state->whave = 0;
     }
 
+    /* if window not allocated yet, allocate it.
+       This block was lost when zlib was vendored -- without it, the first
+       updatewindow() call writes through state->window == NULL (set at
+       inflateInit_ / inflateReset2) and panics.  Restores upstream zlib
+       1.2.8 behaviour; deflate.c:254 already kmalloc()s its own window. */
+    if (state->window == Z_NULL) {
+        state->window = (unsigned char FAR *)
+                        kmalloc(1U << state->wbits,
+                                C_ZLIB_BUFFER_INFLATE, M_INTWAIT);
+        if (state->window == Z_NULL) return 1;
+    }
+
     /* copy state->wsize or less output bytes into the circular window */
     if (copy >= state->wsize) {
         zmemcpy(state->window, end - state->wsize, state->wsize);