--- a/sys/dev/misc/vkbd/vkbd.c
+++ b/sys/dev/misc/vkbd/vkbd.c
@@ -310,6 +310,14 @@
 	/* wakeup poll()ers */
 	KNOTE(&state->ks_rsel.ki_note, 0);
 	KNOTE(&state->ks_wsel.ki_note, 0);
+	/* Detach any knotes that remain so they do not dereference freed state. */
+	{
+		struct knote *kn;
+		while ((kn = SLIST_FIRST(&state->ks_rsel.ki_note)) != NULL)
+			knote_remove(&state->ks_rsel.ki_note, kn);
+		while ((kn = SLIST_FIRST(&state->ks_wsel.ki_note)) != NULL)
+			knote_remove(&state->ks_wsel.ki_note, kn);
+	}
 
 	state->ks_flags &= ~OPEN;
 	state->ks_dev = NULL;