--- sys/netproto/smb/smb_rq.c	2026-06-29 12:51:19.000000000 +0000
+++ /tmp/opencode/fixsrc/sys/netproto/smb/smb_rq.c	2026-10-24 13:14:50.721342845 +0000
@@ -740,7 +740,13 @@
 bad:
 	smb_iod_removerq(rqp);
 freerq:
-	smb_rq_done(rqp);
+	{
+		/* DF-2567 fix: read sr_flags BEFORE the free (was a
+		 * use-after-free read driving the restart decision). */
+		int sr_flags_saved = rqp->sr_flags;
+		smb_rq_done(rqp);
+		rqp->sr_flags = sr_flags_saved;
+	}
 	if (error) {
 		if (rqp->sr_flags & SMBR_RESTART)
 			t2p->t2_flags |= SMBT2_RESTART;