--- a/sys/dev/raid/aac/aac_cam.c
+++ b/sys/dev/raid/aac/aac_cam.c
@@ -199,6 +199,25 @@
 	camsc->inf->aac_cam = NULL;
 
 	lockmgr(&sc->aac_io_lock, LK_EXCLUSIVE);
+
+	/*
+	 * Cancel any pending CMFREE events that reference this sim:
+	 * aac_cam_event() would call xpt_release_simq()/xpt_done()
+	 * on the freed sim after we return.
+	 */
+	{
+		struct aac_event *ev, *evn;
+		TAILQ_FOREACH_MUTABLE(ev, &sc->aac_ev_cmfree, ev_links, evn) {
+			union ccb *eccb = ev->ev_arg;
+			if (eccb->ccb_h.sim_priv.entries[0].ptr == camsc) {
+				TAILQ_REMOVE(&sc->aac_ev_cmfree, ev, ev_links);
+				kfree(ev, M_AACCAM);
+				xpt_release_simq(camsc->sim, 1);
+				eccb->ccb_h.status = CAM_REQ_ABORTED;
+				xpt_done(eccb);
+			}
+		}
+	}
 
 	xpt_async(AC_LOST_DEVICE, camsc->path, NULL);
 	xpt_free_path(camsc->path);