diff --git a/sys/vfs/isofs/cd9660/cd9660_vfsops.c b/sys/vfs/isofs/cd9660/cd9660_vfsops.c
--- a/sys/vfs/isofs/cd9660/cd9660_vfsops.c
+++ b/sys/vfs/isofs/cd9660/cd9660_vfsops.c
@@ -285,6 +285,7 @@
 	struct iso_supplementary_descriptor *sup = NULL;
 	struct iso_directory_record *rootp;
 	int logical_block_size;
+	int root_ext_attr_length;
 	char cs_local[ICONV_CSNMAXLEN];
 	char cs_disk[ICONV_CSNMAXLEN];
 
@@ -428,6 +429,11 @@
 	bcopy (rootp, isomp->root, sizeof isomp->root);
 	isomp->root_extent = isonum_733 (rootp->extent);
 	isomp->root_size = isonum_733 (rootp->size);
+	/*
+	 * Cache ext_attr_length before releasing pribp; rootp points into
+	 * pribp->b_data and would be a stale pointer after brelse().
+	 */
+	root_ext_attr_length = isonum_711(rootp->ext_attr_length);
 
 	isomp->im_bmask = logical_block_size - 1;
 	isomp->im_bshift = ffs(logical_block_size) - 1;
@@ -463,7 +469,7 @@
 	/* Check the Rock Ridge Extension support */
 	if (!(argp->flags & ISOFSMNT_NORRIP)) {
 		if ((error = bread(isomp->im_devvp,
-				  lblktooff(isomp, isomp->root_extent + isonum_711(rootp->ext_attr_length)),
+				  lblktooff(isomp, isomp->root_extent + root_ext_attr_length),
 				  isomp->logical_block_size, &bp)) != 0)
 			goto out;