--- a/sys/kern/vfs_conf.c	2026-06-29 12:51:19.000000000 +0000
+++ b/sys/kern/vfs_conf.c	2026-10-26 00:25:42.777043079 +0000
@@ -458,6 +458,16 @@
 
 		if (!error)
 			break;
+		/*
+		 * Tear down the failed candidate mount (its syncer thread
+		 * and fstype reference) before the next iteration
+		 * overwrites mp.
+		 */
+		vn_syncer_thr_stop(mp);
+		mp->mnt_vfc->vfc_refcount--;
+		vfs_unbusy(mp);
+		kfree(mp, M_MOUNT);
+		mp = NULL;
 end:
 		if(*ep == 0)
 			break;
@@ -506,6 +516,7 @@
 	} else {
 		if (mp != NULL) {
 			vn_syncer_thr_stop(mp);
+			mp->mnt_vfc->vfc_refcount--;
 			vfs_unbusy(mp);
 			kfree(mp, M_MOUNT);
 		}