--- a/sys/net/tap/if_tap.c	2026-09-12 06:54:42.343593350 +0000
+++ b/sys/net/tap/if_tap.c	2026-09-12 06:55:52.378689250 +0000
@@ -966,6 +966,7 @@
 		IFNET_STAT_INC(ifp, ierrors, 1);
 		if (top)
 			m_freem(top);
+		m_freem(m);	/* spare mbuf MGET'd after the faulting uiomove */
 		return (error);
 	}