--- a/sys/bus/pccard/pccard_cis.c
+++ b/sys/bus/pccard/pccard_cis.c
@@ -634,10 +634,20 @@
 		 */
 		if (state->gotmfc == 1) {
 			struct pccard_function *pf, *pfnext;
+			struct pccard_config_entry *cfe;
 
 			for (pf = STAILQ_FIRST(&state->card->pf_head); 
 			     pf != NULL; pf = pfnext) {
 				pfnext = STAILQ_NEXT(pf, pf_list);
+				/* DF-5361: drain the config entries before
+				 * freeing the function, mirroring
+				 * pccard_detach_card (pccard.c:317-324). */
+				while ((cfe = STAILQ_FIRST(&pf->cfe_head))
+					    != NULL) {
+					STAILQ_REMOVE_HEAD(&pf->cfe_head,
+						    cfe_list);
+					kfree(cfe, M_DEVBUF);
+				}
 				kfree(pf, M_DEVBUF);
 			}