--- a/sys/bus/u4b/usb_pf.c
+++ b/sys/bus/u4b/usb_pf.c
@@ -154,7 +154,7 @@
 		return (EINVAL);
 	if (ubus->ifp != NULL)
 		return (EINVAL);
-	ifp = ubus->ifp = if_alloc(IFT_USB);
+	ifp = if_alloc(IFT_USB);
 	if (ifp == NULL) {
 		device_printf(ubus->parent, "usbpf: Could not allocate "
 		    "instance\n");
@@ -176,6 +176,12 @@
 	 */
 	bpfattach(ifp, DLT_USB, USBPF_HDR_LEN);
 
+	/*
+	 * Publish the fully initialized ifnet only now: usbpf_detach()
+	 * and usbpf_xfertap() read ubus->ifp without any lock.
+	 */
+	ubus->ifp = ifp;
+
 	return (0);
 }
 
@@ -186,6 +192,10 @@
 	int unit;
 
 	ubus = ifp->if_softc;
+	if (ubus == NULL) {
+		/* ifnet never finished initializing */
+		return (ENXIO);
+	}
 	unit = ifp->if_dunit;
 
 	ubus->ifp = NULL;
--- a/sys/net/bpf.c
+++ b/sys/net/bpf.c
@@ -1571,7 +1571,7 @@
 	}
 
 	/* Interface wasn't attached */
-	if (bp->bif_ifp == NULL) {
+	if (bp == NULL) {
 		lwkt_reltoken(&bpf_token);
 		kprintf("bpfdetach: %s was not attached\n", ifp->if_xname);
 		return;