diff --git a/lib/libipsec/test-policy.c b/lib/libipsec/test-policy.c
index 3b9d18c64a77..c8fd72732836 100644
--- a/lib/libipsec/test-policy.c
+++ b/lib/libipsec/test-policy.c
@@ -35,7 +35,7 @@
 
 #include <netinet/in.h>
 #include <netinet6/in6.h>
-#include <netkey/keyv2.h>
+#include <net/pfkeyv2.h>
 #include <netkey/key_debug.h>
 #include <netinet6/ipsec.h>
 
diff --git a/sys/netinet/ip_output.c b/sys/netinet/ip_output.c
index d9867d282ccd..ee361ce401c9 100644
--- a/sys/netinet/ip_output.c
+++ b/sys/netinet/ip_output.c
@@ -1227,7 +1227,7 @@ ip_ctloutput(so, sopt)
 #ifdef IPSEC
 		case IP_IPSEC_POLICY:
 		{
-			struct mbuf *m;
+			struct mbuf *m = NULL;
 			caddr_t req = NULL;
 
 			if (m != 0)
@@ -1235,7 +1235,8 @@ ip_ctloutput(so, sopt)
 			error = ipsec4_get_policy(sotoinpcb(so), req, &m);
 			if (error == 0)
 				error = soopt_mcopyout(sopt, m); /* XXX */
-			m_freem(m);
+			if (error == 0)
+				m_freem(m);
 			break;
 		}
 #endif /*IPSEC*/
diff --git a/sys/netinet6/ip6_output.c b/sys/netinet6/ip6_output.c
index fb8545418fb6..c7d0499611df 100644
--- a/sys/netinet6/ip6_output.c
+++ b/sys/netinet6/ip6_output.c
@@ -1509,19 +1509,17 @@ ip6_ctloutput(so, sopt)
 #ifdef IPSEC
 			case IPV6_IPSEC_POLICY:
 			  {
-				caddr_t req = NULL;
-				int len = 0;
-				struct mbuf *m;
-				struct mbuf **mp = &m;
 
-				if (m != 0) {
+				struct mbuf *m = NULL;
+				caddr_t req = NULL;
+
+				if (m != 0)
 					req = mtod(m, caddr_t);
-					len = m->m_len;
-				}
-				error = ipsec6_get_policy(in6p, req, mp);
+				error = ipsec6_get_policy(in6p, req, &m);
 				if (error == 0)
 					error = soopt_mcopyout(sopt, m); /*XXX*/
-				m_freem(m);
+				if (error == 0)
+					m_freem(m);
 				break;
 			  }
 #endif /* IPSEC */