--- a/sys/vfs/fuse/fuse_vfsops.c
+++ b/sys/vfs/fuse/fuse_vfsops.c
@@ -390,6 +390,12 @@
 	struct fuse_statfs_out *fso;
 	int error;
 
+	/* fuse_unmount() clears mp->mnt_data before returning; an
+	 * fstatfs(2) on a still-open fd can land here with fmp == NULL
+	 * (kern_fstatfs uses fp->f_nchandle.mount, no vnode ops). */
+	if (fmp == NULL || fuse_test_dead(fmp))
+		return ENOTCONN;
+
 	fip = fuse_ipc_get(fmp, 0);
 	fuse_ipc_fill(fip, FUSE_STATFS, FUSE_ROOT_ID, cred);
 	error = fuse_ipc_tx(fip);
@@ -421,6 +427,9 @@
 	struct fuse_statfs_out *fso;
 	int error;
 
+	if (fmp == NULL || fuse_test_dead(fmp))
+		return ENOTCONN;
+
 	fip = fuse_ipc_get(fmp, 0);
 	fuse_ipc_fill(fip, FUSE_STATFS, FUSE_ROOT_ID, cred);
 	error = fuse_ipc_tx(fip);