--- if_urndis.c.orig	2026-10-04 04:26:45.269523718 +0000
+++ if_urndis.c.fixed	2026-10-04 04:26:45.277523616 +0000
@@ -307,7 +307,19 @@
 	return (0);			/* success */
 
 detach:
-	urndis_detach(dev);
+	/*
+	 * The usb_ether embedded in the softc has NOT been initialised on
+	 * any path that reaches this label (ue_lock, ue_methods and friends
+	 * are assigned only after the last failure goto, and
+	 * uether_ifattach() has never run): calling urndis_detach() here
+	 * makes uether_ifdetach() tear down a zeroed usb_ether --
+	 * on DragonFly uether_getifp() returns the address of the embedded
+	 * (never-NULL) ac_if, so the NULL ue_lock is passed to lockmgr()
+	 * and the kernel takes a page fault on VA 0.  Tear down only the
+	 * pieces that were actually set up (the USB transfers and the lock).
+	 */
+	usbd_transfer_unsetup(sc->sc_xfer, URNDIS_N_TRANSFER);
+	lockuninit(&sc->sc_lock);
 	return (ENXIO);			/* failure */
 }