--- a/sys/netgraph/ppp/ng_ppp.c
+++ b/sys/netgraph/ppp/ng_ppp.c
@@ -1745,10 +1745,23 @@ ng_ppp_mp_strategy(node_p node, int len, int *distrib)
 	}
 
-	/* Sort active links by latency */
-	compareLatencies = latency;
-	kqsort(sortByLatency,
-	    priv->numActiveLinks, sizeof(*sortByLatency), ng_ppp_intcmp);
-	compareLatencies = NULL;
+	/*
+	 * Sort active links by latency.  Do NOT use a file-scope global
+	 * as qsort comparator state: concurrent invocations of this
+	 * function (different bundles / different threads in v1
+	 * netgraph, which has no per-node funnel) would race the
+	 * global, including the "compareLatencies = NULL" store, which
+	 * turns every in-flight comparator call into a NULL-index
+	 * dereference (kernel panic).  Insertion sort over at most
+	 * NG_PPP_MAX_LINKS entries with local state only.
+	 */
+	{
+		int a, b;
+
+		for (a = 1; a < priv->numActiveLinks; a++) {
+			const int cur = sortByLatency[a];
+
+			for (b = a - 1; b >= 0 &&
+			    latency[sortByLatency[b]] > latency[cur]; b--)
+				sortByLatency[b + 1] = sortByLatency[b];
+			sortByLatency[b + 1] = cur;
+		}
+	}