--- a/sys/netgraph7/pppoe/ng_pppoe.c
+++ b/sys/netgraph7/pppoe/ng_pppoe.c
@@ -1808,7 +1808,14 @@
 {
 	priv_p privp = NG_NODE_PRIVATE(NG_HOOK_NODE(hook));
 	sessp	sp = NG_HOOK_PRIVATE(hook);
-	negp	neg = sp->neg;
+	negp	neg;
+
+	/* Disconnect may have freed the session after this item queued. */
+	if (sp == NULL)
+		return;
+	neg = sp->neg;
+	if (neg == NULL)
+		return;
 	struct mbuf *m0 = NULL;
 	int	error = 0;