diff --git a/sys/netinet/tcp_input.c b/sys/netinet/tcp_input.c
index f69262230a05..cfb0989a7203 100644
--- a/sys/netinet/tcp_input.c
+++ b/sys/netinet/tcp_input.c
@@ -1341,7 +1341,8 @@ tcp_input(struct mbuf **mp, int *offp, int proto)
 #endif
 		TCP_PROBE3(debug__input, tp, th, m);
 		tcp_dooptions(&to, optp, optlen, TO_SYN);
-		if (syncache_add(&inc, &to, th, inp, &so, m, NULL, NULL, iptos))
+		if ((so = syncache_add(&inc, &to, th, inp, so, m, NULL, NULL,
+		    iptos)) != NULL)
 			goto tfo_socket_result;
 
 		/*
diff --git a/sys/netinet/tcp_syncache.c b/sys/netinet/tcp_syncache.c
index b1a0c1f7e229..7c6bad415d7d 100644
--- a/sys/netinet/tcp_syncache.c
+++ b/sys/netinet/tcp_syncache.c
@@ -1322,24 +1322,25 @@ syncache_expand(struct in_conninfo *inc, struct tcpopt *to, struct tcphdr *th,
 	return (0);
 }
 
-static void
-syncache_tfo_expand(struct syncache *sc, struct socket **lsop, struct mbuf *m,
+static struct socket *
+syncache_tfo_expand(struct syncache *sc, struct socket *lso, struct mbuf *m,
     uint64_t response_cookie)
 {
 	struct inpcb *inp;
 	struct tcpcb *tp;
 	unsigned int *pending_counter;
+	struct socket *so;
 
 	NET_EPOCH_ASSERT();
 
-	pending_counter = intotcpcb(sotoinpcb(*lsop))->t_tfo_pending;
-	*lsop = syncache_socket(sc, *lsop, m);
-	if (*lsop == NULL) {
+	pending_counter = intotcpcb(sotoinpcb(lso))->t_tfo_pending;
+	so = syncache_socket(sc, lso, m);
+	if (so == NULL) {
 		TCPSTAT_INC(tcps_sc_aborted);
 		atomic_subtract_int(pending_counter, 1);
 	} else {
-		soisconnected(*lsop);
-		inp = sotoinpcb(*lsop);
+		soisconnected(so);
+		inp = sotoinpcb(so);
 		tp = intotcpcb(inp);
 		tp->t_flags |= TF_FASTOPEN;
 		tp->t_tfo_cookie.server = response_cookie;
@@ -1348,6 +1349,8 @@ syncache_tfo_expand(struct syncache *sc, struct socket **lsop, struct mbuf *m,
 		tp->t_tfo_pending = pending_counter;
 		TCPSTAT_INC(tcps_sc_completed);
 	}
+
+	return (so);
 }
 
 /*
@@ -1369,20 +1372,19 @@ syncache_tfo_expand(struct syncache *sc, struct socket **lsop, struct mbuf *m,
  * be ACKed either when the application sends response data or the delayed
  * ACK timer expires, whichever comes first.
  */
-int
+struct socket *
 syncache_add(struct in_conninfo *inc, struct tcpopt *to, struct tcphdr *th,
-    struct inpcb *inp, struct socket **lsop, struct mbuf *m, void *tod,
+    struct inpcb *inp, struct socket *so, struct mbuf *m, void *tod,
     void *todctx, uint8_t iptos)
 {
 	struct tcpcb *tp;
-	struct socket *so;
+	struct socket *rv = NULL;
 	struct syncache *sc = NULL;
 	struct syncache_head *sch;
 	struct mbuf *ipopts = NULL;
 	u_int ltflags;
 	int win, ip_ttl, ip_tos;
 	char *s;
-	int rv = 0;
 #ifdef INET6
 	int autoflowlabel = 0;
 #endif
@@ -1405,7 +1407,6 @@ syncache_add(struct in_conninfo *inc, struct tcpopt *to, struct tcphdr *th,
 	 * Combine all so/tp operations very early to drop the INP lock as
 	 * soon as possible.
 	 */
-	so = *lsop;
 	KASSERT(SOLISTENING(so), ("%s: %p not listening", __func__, so));
 	tp = sototcpcb(so);
 	cred = crhold(so->so_cred);
@@ -1734,9 +1735,8 @@ syncache_add(struct in_conninfo *inc, struct tcpopt *to, struct tcphdr *th,
 		SCH_UNLOCK(sch);
 
 	if (tfo_cookie_valid) {
-		syncache_tfo_expand(sc, lsop, m, tfo_response_cookie);
+		rv = syncache_tfo_expand(sc, so, m, tfo_response_cookie);
 		/* INP_RUNLOCK(inp) will be performed by the caller */
-		rv = 1;
 		goto tfo_expanded;
 	}
 
@@ -1761,10 +1761,8 @@ syncache_add(struct in_conninfo *inc, struct tcpopt *to, struct tcphdr *th,
 done:
 	TCP_PROBE5(receive, NULL, NULL, m, NULL, th);
 donenoprobe:
-	if (m) {
-		*lsop = NULL;
+	if (m)
 		m_freem(m);
-	}
 	/*
 	 * If tfo_pending is not NULL here, then a TFO SYN that did not
 	 * result in a new socket was processed and the associated pending
diff --git a/sys/netinet/tcp_syncache.h b/sys/netinet/tcp_syncache.h
index 37575a14467c..c56dce55f1c1 100644
--- a/sys/netinet/tcp_syncache.h
+++ b/sys/netinet/tcp_syncache.h
@@ -43,8 +43,8 @@ void	syncache_destroy(void);
 void	 syncache_unreach(struct in_conninfo *, tcp_seq);
 int	 syncache_expand(struct in_conninfo *, struct tcpopt *,
 	     struct tcphdr *, struct socket **, struct mbuf *);
-int	 syncache_add(struct in_conninfo *, struct tcpopt *,
-	     struct tcphdr *, struct inpcb *, struct socket **, struct mbuf *,
+struct socket *	 syncache_add(struct in_conninfo *, struct tcpopt *,
+	     struct tcphdr *, struct inpcb *, struct socket *, struct mbuf *,
 	     void *, void *, uint8_t);
 void	 syncache_chkrst(struct in_conninfo *, struct tcphdr *, struct mbuf *);
 void	 syncache_badack(struct in_conninfo *);
diff --git a/sys/netinet/toecore.c b/sys/netinet/toecore.c
index 28cbd8b43e4f..f602319ef701 100644
--- a/sys/netinet/toecore.c
+++ b/sys/netinet/toecore.c
@@ -348,11 +348,11 @@ void
 toe_syncache_add(struct in_conninfo *inc, struct tcpopt *to, struct tcphdr *th,
     struct inpcb *inp, void *tod, void *todctx, uint8_t iptos)
 {
-	struct socket *lso = inp->inp_socket;
 
 	INP_WLOCK_ASSERT(inp);
 
-	syncache_add(inc, to, th, inp, &lso, NULL, tod, todctx, iptos);
+	(void )syncache_add(inc, to, th, inp, inp->inp_socket, NULL, tod,
+	    todctx, iptos);
 }
 
 int