--- a/sys/bus/cam/scsi/scsi_target.c
+++ b/sys/bus/cam/scsi/scsi_target.c
@@ -934,6 +934,14 @@
 			goto read_fail;
 		read_len += sizeof(user_ccb);
 
+		/*
+		 * DF-2287: this descriptor just left the abort_queue and
+		 * no other code path can reach it (targfreeccb is only
+		 * invoked for user_ccb_queue entries; targdtor only drains
+		 * what is STILL queued) -- free it.
+		 */
+		kfree(user_descr, M_TARG);
+
 		user_descr = TAILQ_FIRST(abort_queue);
 	}