diff --git a/stand/common/gfx_fb.h b/stand/common/gfx_fb.h
index e55f6fc13fe5..f5747e065daf 100644
--- a/stand/common/gfx_fb.h
+++ b/stand/common/gfx_fb.h
@@ -217,6 +217,7 @@ typedef struct teken_gfx {
 	struct vt_font	tg_font;
 	struct gen_fb	tg_fb;
 	uint32_t	*tg_shadow_fb;		/* units of 4 bytes */
+	size_t		tg_shadow_sz;		/* units of pages */
 	teken_funcs_t	*tg_functions;
 	void		*tg_private;
 } teken_gfx_t;
diff --git a/stand/efi/loader/framebuffer.c b/stand/efi/loader/framebuffer.c
index 0a00b3645b36..d5504c9cff35 100644
--- a/stand/efi/loader/framebuffer.c
+++ b/stand/efi/loader/framebuffer.c
@@ -634,9 +634,18 @@ efi_find_framebuffer(teken_gfx_t *gfx_state)
 	gfx_state->tg_fb.fb_bpp = fls(efifb.fb_mask_red | efifb.fb_mask_green |
 	    efifb.fb_mask_blue | efifb.fb_mask_reserved);
 
-	free(gfx_state->tg_shadow_fb);
-	gfx_state->tg_shadow_fb = malloc(efifb.fb_height * efifb.fb_width *
+	if (gfx_state->tg_shadow_fb != NULL)
+		BS->FreePages((EFI_PHYSICAL_ADDRESS)gfx_state->tg_shadow_fb,
+		    gfx_state->tg_shadow_sz);
+	gfx_state->tg_shadow_sz =
+	    EFI_SIZE_TO_PAGES(efifb.fb_height * efifb.fb_width *
 	    sizeof(EFI_GRAPHICS_OUTPUT_BLT_PIXEL));
+	status = BS->AllocatePages(AllocateMaxAddress, EfiLoaderData,
+	    gfx_state->tg_shadow_sz,
+	    (EFI_PHYSICAL_ADDRESS *)&gfx_state->tg_shadow_fb);
+	if (status != EFI_SUCCESS)
+		gfx_state->tg_shadow_fb = NULL;
+
 	return (0);
 }