diff --git a/sys/bus/u4b/usb_pf.c b/sys/bus/u4b/usb_pf.c
--- a/sys/bus/u4b/usb_pf.c
+++ b/sys/bus/u4b/usb_pf.c
@@ -188,7 +188,13 @@
 	ubus = ifp->if_softc;
 	unit = ifp->if_dunit;
 
+	/* Synchronize with usbpf_xfertap(), which checks bus->ifp under the
+	   USB bus lock and then dereferences bus->ifp->if_bpf.  Without this
+	   lock the NULL-ing + if_free() here race the use, producing a NULL
+	   deref or a use-after-free read on the freed ifnet. */
+	USB_BUS_LOCK(ubus);
 	ubus->ifp = NULL;
+	USB_BUS_UNLOCK(ubus);
 	bpfdetach(ifp);
 	if_detach(ifp);
 	if_free(ifp);