--- a/sys/bus/iicbus/iic.c	2026-06-29 12:51:18.000000000 +0000
+++ b/sys/bus/iicbus/iic.c	2026-10-15 00:00:00.000000000 +0000
@@ -350,7 +350,8 @@
 	case I2CRDWR:
 		buf = kmalloc(sizeof(*d->msgs) * d->nmsgs, M_TEMP, M_WAITOK);
 		usrbufs = kmalloc(sizeof(void *) * d->nmsgs, M_TEMP, M_ZERO | M_WAITOK);
 		error = copyin(d->msgs, buf, sizeof(*d->msgs) * d->nmsgs);
 		if (error)
+			kfree(usrbufs, M_TEMP);
 			break;
 		/* Alloc kernel buffers for userland data, copyin write data */
 		for (i = 0; i < d->nmsgs; i++) {