--- a/sys/dev/netif/oce/oce_queue.c	2026-09-20 00:48:04.237785966 +0000
+++ b/sys/dev/netif/oce/oce_queue.c	2026-09-20 00:48:13.869662108 +0000
@@ -684,6 +684,13 @@
 		goto error;
 	}
 
+	/*
+	 * Keep the cq reachable for oce_mq_free() on every error path,
+	 * so it is not leaked if ring creation or the mailbox command
+	 * fails below.
+	 */
+	mq->cq = cq;
+
 	mq->parent = sc;
 
 	mq->ring = oce_create_ring_buffer(sc, q_len, sizeof(struct oce_mbx));
@@ -741,7 +748,6 @@
 		goto error;
 	}
 	mq->mq_id = LE_16(fwcmd->params.rsp.mq_id);
-	mq->cq = cq;
 	eq->cq[eq->cq_valid] = cq;
 	eq->cq_valid++;
 	mq->cq->eq = eq;