--- a/sys/netgraph/ng_sample.c	2026-09-14 20:30:13.466637150 +0000
+++ b/sys/netgraph/ng_sample.c	2026-09-14 20:30:22.602521934 +0000
@@ -388,9 +388,12 @@
 			xxxp->packets_in++;
 		}
 	} else {
-		/* It's the debug hook, throw it away.. */
-		if (hook == xxxp->downstream_hook.hook)
-			NG_FREE_DATA(m, meta);
+		/*
+		 * private == NULL implies the debug hook (the downstream
+		 * hook always has private set in ng_xxx_newhook), so the
+		 * old downstream comparison was dead code and leaked m+meta.
+		 */
+		NG_FREE_DATA(m, meta);
 	}
 	return 0;
 }