--- a/sys/net/sppp/if_spppsubr.c
+++ b/sys/net/sppp/if_spppsubr.c
@@ sppp_cisco_send / sppp_cp_send / sppp_auth_send (3 sites)
 	Capture the packet length BEFORE the IF_QFULL/m_freem branch and use
 	the captured value in the obytes accounting:
 
+	int obytes_len = m->m_pkthdr.len;	/* capture before free */
 	if (IF_QFULL (&sp->pp_cpq)) {
 		IF_DROP (&sp->pp_fastq);
 		m_freem (m);
@@
-	IFNET_STAT_INC(ifp, obytes, m->m_pkthdr.len + 3);
+	IFNET_STAT_INC(ifp, obytes, obytes_len + 3);