--- a/sys/dev/netif/tl/if_tl.c +++ b/sys/dev/netif/tl/if_tl.c @@ -1853,7 +1880,18 @@ cur_tx->tl_next = NULL; /* Pack the data into the list. */ - tl_encap(sc, cur_tx, m_head); + if (tl_encap(sc, cur_tx, m_head) != 0) { + /* + * tl_encap failed (cluster collapse OOM): it freed + * nothing and armed nothing. Drop the packet and + * return the chain entry instead of chaining a + * non-READY list and tapping a NULL mbuf into BPF. + */ + m_freem(m_head); + cur_tx->tl_next = sc->tl_cdata.tl_tx_free; + sc->tl_cdata.tl_tx_free = cur_tx; + continue; + } /* Chain it together */ if (prev != NULL) {