--- a/sys/vfs/fuse/fuse_ipc.c
+++ b/sys/vfs/fuse/fuse_ipc.c
@@ -270,6 +270,10 @@
 		fuse_ipc_put(fip);
 		return error;
 	}
+	/* A reply may complete us before the daemon READ the request
+	 * (fuse_device_write does not check fip->sent): dequeue from
+	 * request_head so the caller's put() cannot free a linked fip. */
+	fuse_ipc_remove(fip);
 
 	ohd = fuse_out(fip);
 	KKASSERT(ohd);