diff --git a/sys/net/vlan/if_vlan.c b/sys/net/vlan/if_vlan.c
--- a/sys/net/vlan/if_vlan.c
+++ b/sys/net/vlan/if_vlan.c
@@ -946,6 +946,12 @@ vlan_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data, struct ucred *cr)
 	switch (cmd) {
 	case SIOCGIFMEDIA:
+		/*
+		 * DF-3394: do not chase the parent ifnet pointer on the
+		 * ioctl thread.  All vlan re/configuration (including the
+		 * unconfig triggered by parent destroy/rename) is serialized
+		 * on netisr0; running the parent query there closes the
+		 * use-after-free window on the raw ifv_p pointer.
+		 */
 		ifp_p = ifv->ifv_p;
 		if (ifp_p != NULL) {
 			/*