--- a/sys/dev/raid/mrsas/mrsas_ioctl.c
+++ b/sys/dev/raid/mrsas/mrsas_ioctl.c
@@ -421,12 +421,13 @@ int mrsas_alloc_mfi_cmds(struct mrsas_softc *sc)
 
     /* create a frame pool and assign one frame to each command */
     if (mrsas_create_frame_pool(sc)) {
         device_printf(sc->mrsas_dev, "Cannot allocate DMA frame pool.\n");
-        for (i = 0; i < MRSAS_MAX_MFI_CMDS; i++) { // Free the frames
-            cmd = sc->mfi_cmd_list[i];
-            mrsas_free_frame(sc, cmd);
-        }
-        if (sc->mficmd_frame_tag != NULL)
-            bus_dma_tag_destroy(sc->mficmd_frame_tag);
+        /*
+         * Do NOT free the frames or destroy the tag here.  The caller
+         * unwinds via mrsas_free_mem() (mrsas.c attach_fail_fw), which
+         * frees the frames and destroys the tag.  Freeing them here
+         * without clearing cmd->frame_mem/frame_phys_addr and
+         * sc->mfi_cmd_list/sc->mficmd_frame_tag makes mrsas_free_mem()
+         * double-free every allocated frame and the tag itself.
+         */
         return(ENOMEM);
     }