--- a/sys/vfs/procfs/procfs_map.c
+++ b/sys/vfs/procfs/procfs_map.c
@@ -178,8 +178,13 @@ procfs_domap(struct proc *curp, struct lwp *lp, struct pfsnode *pfs,
 			vm_object_drop(obj);
 			if (vp) {
-				vn_fullpath(p, vp, &fullpath, &freepath, 1);
+				/*
+				 * p->p_fd is freed (set to NULL, then
+				 * kfree'd) by the target's exit1() ->
+				 * fdfree() while we hold neither p_token
+				 * nor the map lock; serialize against it.
+				 */
+				lwkt_gettoken(&p->p_token);
+				vn_fullpath(p, vp, &fullpath, &freepath, 1);
+				lwkt_reltoken(&p->p_token);
 				vrele(vp);
 			}
--- a/sys/kern/vfs_cache.c
+++ b/sys/kern/vfs_cache.c
@@ -5191,7 +5191,11 @@ cache_fullpath(struct proc *p, struct nchandle *nchp, struct nchandle *nchbase,
 	if (nchbase)
 		fd_nrdir = *nchbase;
 	else if (p != NULL)
-		fd_nrdir = p->p_fd->fd_nrdir;
+		if (p->p_fd != NULL) {
+			fd_nrdir = p->p_fd->fd_nrdir;
+		} else {
+			fd_nrdir = rootnch;
+		}
 	else
 		fd_nrdir = rootnch;