--- a/sys/netgraph7/netgraph/ng_base.c
+++ b/sys/netgraph7/netgraph/ng_base.c
@@ -3263,6 +3263,14 @@ ng_callout(struct callout *c, node_p node, hook_p hook, int ticks,
 	NGI_FN(item) = fn;
 	NGI_ARG1(item) = arg1;
 	NGI_ARG2(item) = arg2;
 	oitem = callout_arg(c);
 	callout_reset(c, ticks, &ng_callout_trampoline, item);
+	/*
+	 * If a previous ng_callout() item was still armed on this callout,
+	 * it is now orphaned and its node/hook references would leak
+	 * forever. Free it if it never entered the send path (refs == 0).
+	 */
+	if (oitem != NULL && oitem != item && oitem->refs == 0)
+		ng_free_item(oitem);
+	else if (oitem != NULL && oitem != item)
+		NG_FREE_ITEM(oitem);	/* in flight: apply path unrefs */
 	return (0);
 }