--- a/sys/dev/netif/sf/if_sf.c
+++ b/sys/dev/netif/sf/if_sf.c
@@ -774,9 +774,17 @@ sf_attach(device_t dev)
 	error = bus_setup_intr(dev, sc->sf_irq, INTR_MPSAFE,
 			       sf_intr, sc, &sc->sf_intrhand, 
 			       ifp->if_serializer);
 
 	if (error) {
-		ether_ifdetach(ifp);
 		device_printf(dev, "couldn't set up irq\n");
 		goto fail;
 	}
@@ -793,10 +801,14 @@ sf_detach(device_t dev)
 	struct sf_softc *sc = device_get_softc(dev);
 	struct ifnet *ifp = &sc->arpcom.ac_if;
 
 	if (device_is_attached(dev)) {
 		lwkt_serialize_enter(ifp->if_serializer);
 		sf_stop(sc);
-		bus_teardown_intr(dev, sc->sf_irq, sc->sf_intrhand);
+		/*
+		 * sc->sf_intrhand is NULL when bus_setup_intr() failed
+		 * during attach (the very error path that jumps here);
+		 * guard the teardown cookie.
+		 */
+		if (sc->sf_intrhand != NULL)
+			bus_teardown_intr(dev, sc->sf_irq, sc->sf_intrhand);
 		lwkt_serialize_exit(ifp->if_serializer);
 
 		ether_ifdetach(ifp);