diff --git a/sys/net/if_stf.c b/sys/net/if_stf.c
index 911804e46663..d463ff63485b 100644
--- a/sys/net/if_stf.c
+++ b/sys/net/if_stf.c
@@ -349,8 +349,10 @@ stf_encapcheck(m, off, proto, arg)
 	 * success on: dst = 10.1.1.1, ia6->ia_addr = 2002:0a01:0101:...
 	 */
 	if (bcmp(GET_V4(&ia6->ia_addr.sin6_addr), &ip.ip_dst,
-	    sizeof(ip.ip_dst)) != 0)
+	    sizeof(ip.ip_dst)) != 0) {
+		ifa_free(&ia6->ia_ifa);
 		return 0;
+	}
 
 	/*
 	 * check if IPv4 src matches the IPv4 address derived from the
@@ -361,6 +363,7 @@ stf_encapcheck(m, off, proto, arg)
 	bzero(&a, sizeof(a));
 	bcopy(GET_V4(&ia6->ia_addr.sin6_addr), &a, sizeof(a));
 	bcopy(GET_V4(&ia6->ia_prefixmask.sin6_addr), &mask, sizeof(mask));
+	ifa_free(&ia6->ia_ifa);
 	a.s_addr &= mask.s_addr;
 	b = ip.ip_src;
 	b.s_addr &= mask.s_addr;
@@ -396,6 +399,7 @@ stf_getsrcifa6(ifp)
 		if (ia4 == NULL)
 			continue;
 
+		ifa_ref(ia);
 		IF_ADDR_UNLOCK(ifp);
 		return (struct in6_ifaddr *)ia;
 	}
@@ -457,6 +461,7 @@ stf_output(ifp, m, dst, ro)
 	if (m->m_len < sizeof(*ip6)) {
 		m = m_pullup(m, sizeof(*ip6));
 		if (!m) {
+			ifa_free(&ia6->ia_ifa);
 			ifp->if_oerrors++;
 			return ENOBUFS;
 		}
@@ -483,6 +488,7 @@ stf_output(ifp, m, dst, ro)
 	else if (IN6_IS_ADDR_6TO4(&dst6->sin6_addr))
 		ptr = GET_V4(&dst6->sin6_addr);
 	else {
+		ifa_free(&ia6->ia_ifa);
 		m_freem(m);
 		ifp->if_oerrors++;
 		return ENETUNREACH;
@@ -505,6 +511,7 @@ stf_output(ifp, m, dst, ro)
 	if (m && m->m_len < sizeof(struct ip))
 		m = m_pullup(m, sizeof(struct ip));
 	if (m == NULL) {
+		ifa_free(&ia6->ia_ifa);
 		ifp->if_oerrors++;
 		return ENOBUFS;
 	}
@@ -514,6 +521,7 @@ stf_output(ifp, m, dst, ro)
 
 	bcopy(GET_V4(&((struct sockaddr_in6 *)&ia6->ia_addr)->sin6_addr),
 	    &ip->ip_src, sizeof(ip->ip_src));
+	ifa_free(&ia6->ia_ifa);
 	bcopy(&in4, &ip->ip_dst, sizeof(ip->ip_dst));
 	ip->ip_p = IPPROTO_IPV6;
 	ip->ip_ttl = ip_stf_ttl;