--- a/sys/vfs/fuse/fuse_ipc.c
+++ b/sys/vfs/fuse/fuse_ipc.c
@@ -162,6 +162,9 @@
 
 	if (fuse_test_dead(fip->fmp)) {
 		KKASSERT(!fuse_ipc_test_replied(fip));
+		/* Still linked on request_head/reply_head: dequeue before
+		 * the caller's put() frees us (error-path UAF). */
+		fuse_ipc_remove(fip);
 		fuse_ipc_set_replied(fip);
 		return ENOTCONN;
 	}
@@ -197,6 +200,11 @@
 
 	if (fuse_test_dead(fip->fmp)) {
 		KKASSERT(fuse_ipc_test_replied(fip));
+		/* The reply may have been matched by fuse_device_write
+		 * without the daemon reading the request: we can still be
+		 * linked on request_head.  Dequeue before the caller's
+		 * put() frees us. */
+		fuse_ipc_remove(fip);
 		return ENOTCONN;
 	}