diff --git a/sys/netipsec/ipsec_output.c b/sys/netipsec/ipsec_output.c
index 0907f4575518..7c21d837208a 100644
--- a/sys/netipsec/ipsec_output.c
+++ b/sys/netipsec/ipsec_output.c
@@ -247,7 +247,6 @@ ipsec_process_done(struct mbuf *m, struct ipsecrequest *isr)
 	panic("ipsec_process_done");
 bad:
 	m_freem(m);
-	KEY_FREESAV(&sav);
 	return (error);
 }
 
diff --git a/sys/netipsec/xform_ah.c b/sys/netipsec/xform_ah.c
index 5701f90f71dc..6a2d3517db96 100644
--- a/sys/netipsec/xform_ah.c
+++ b/sys/netipsec/xform_ah.c
@@ -785,6 +785,7 @@ ah_input_cb(struct cryptop *crp)
 			sav->tdb_cryptoid = crp->crp_sid;
 
 		if (crp->crp_etype == EAGAIN) {
+			KEY_FREESAV(&sav);
 			error = crypto_dispatch(crp);
 			return error;
 		}