diff --git a/sys/dev/disk/dm/dm_ioctl.c b/sys/dev/disk/dm/dm_ioctl.c
index 0000000..1111111 100644
--- a/sys/dev/disk/dm/dm_ioctl.c
+++ b/sys/dev/disk/dm/dm_ioctl.c
@@ -768,6 +768,13 @@
 		 * null and therefore it should be checked before we try to
 		 * use it.
 		 */
+		/*
+		 * Reset str each iteration: prop_dictionary_get_cstring()
+		 * only writes *cpp on success, so a missing params key would
+		 * otherwise leave a stale (and after kfree below, dangling)
+		 * pointer -- see DF-1640.
+		 */
+		str = NULL;
 		prop_dictionary_get_cstring(target_dict,
 		    DM_TABLE_PARAMS, &str);
 
@@ -783,12 +790,14 @@
 		if ((ret = dm_table_init(target, table_en, str)) != 0) {
 			dm_table_release(&dmv->table_head, DM_TABLE_INACTIVE);
 			dm_table_destroy(&dmv->table_head, DM_TABLE_INACTIVE);
-			kfree(str, M_TEMP);
+			if (str != NULL)
+				kfree(str, M_TEMP);
 
 			dm_dev_unbusy(dmv);
 			return ret;
 		}
-		kfree(str, M_TEMP);
+		if (str != NULL)
+			kfree(str, M_TEMP);
 	}
 	prop_object_iterator_release(iter);