diff --git a/sys/vfs/hpfs/hpfs_vfsops.c b/sys/vfs/hpfs/hpfs_vfsops.c
--- a/sys/vfs/hpfs/hpfs_vfsops.c
+++ b/sys/vfs/hpfs/hpfs_vfsops.c
@@ -221,7 +221,7 @@
 	int error, ncount, ronly;
 	struct sublock *sup;
 	struct spblock *spp;
-	struct hpfsmount *hpmp;
+	struct hpfsmount *hpmp = NULL;
 	struct buf *bp = NULL;
 	struct vnode *vp;
 	cdev_t dev;
@@ -328,6 +328,16 @@
 failed:
 	if (bp)
 		brelse (bp);
+	/*
+	 * DF-0889: hpfs_mountfs kmalloc's hpmp early (line 262) but every
+	 * error path after that runs through `failed:` without freeing it,
+	 * leaking one struct hpfsmount per failed mount attempt. Free it
+	 * here; hpmp is NULL until the kmalloc, and the bminit/cpinit
+	 * sub-allocations are already deinited by the goto sites above
+	 * (or never made), so a plain kfree is correct.
+	 */
+	if (hpmp != NULL)
+		kfree(hpmp, M_HPFSMNT);
 	mp->mnt_data = NULL;
 	dev->si_mountpoint = NULL;
 	vn_lock(devvp, LK_EXCLUSIVE | LK_RETRY);