--- a/sys/kern/uipc_mbuf.c	2026-06-29 12:51:19.000000000 +0000
+++ b/sys/kern/uipc_mbuf.c	2026-10-26 05:32:30.899442742 +0000
@@ -1803,7 +1803,21 @@
 		moff = 0;
 
 		while (mlen) {
-			KKASSERT(m->m_type == MT_DATA);
+			/*
+			 * MT_HEADER mbufs legitimately appear in stream data
+			 * chains: tcp_output() builds each segment in an
+			 * m_gethdr(..., MT_HEADER) mbuf and, when the payload
+			 * fits inline, the whole segment is one MT_HEADER
+			 * mbuf; over the loopback interface that same mbuf
+			 * (header-stripped) is appended to the receiving
+			 * socket buffer, and soreceive() hands it back to
+			 * nfs_realign() callers (uipc_socket.c accepts
+			 * MT_HEADER for stream data).  Accept both types;
+			 * only the data region is copied, so the copy is a
+			 * pure MT_DATA chain either way.
+			 */
+			KKASSERT(m->m_type == MT_DATA ||
+				 m->m_type == MT_HEADER);
 			if (n == NULL) {
 				n = m_getl(gsize, how, MT_DATA, 0, &nsize);
 				if (n == NULL)