--- a/sys/kern/lwkt_thread.c	2026-06-29 12:51:19.000000000 +0000
+++ b/sys/kern/lwkt_thread.c	2026-10-26 00:25:42.789042927 +0000
@@ -1694,6 +1694,15 @@
     dsched_exit_thread(td);
 
     /*
+     * Drop the ucred reference taken at thread creation.  LWP threads
+     * already dropped theirs (and NULLed the field) in kern_exit.c.
+     */
+    if (td->td_ucred) {
+	crfree(td->td_ucred);
+	td->td_ucred = NULL;
+    }
+
+    /*
      * Get us into a critical section to interlock gd_freetd and loop
      * until we can get it freed.
      *