From 9b48646ab366dcf6089fac653eef963331aa1169 Mon Sep 17 00:00:00 2001
From: Konstantin Belousov <kib@FreeBSD.org>
Date: Wed, 10 Jun 2026 13:29:05 +0300
Subject: [PATCH] kern_fork: guard against NULL newproc on the failure path

Reported and tested by:	pho
Fixes:	85a65e393092 ("proc: add tree ref count")
Sponsored by:	The FreeBSD Foundation
MFC after:	1 week
---
 sys/kern/kern_fork.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/sys/kern/kern_fork.c b/sys/kern/kern_fork.c
index 5318a737ea3..26e2510698e 100644
--- a/sys/kern/kern_fork.c
+++ b/sys/kern/kern_fork.c
@@ -1132,7 +1132,8 @@ fork1(struct thread *td, struct fork_req *fr)
 fail2:
 	if (vm2 != NULL)
 		vmspace_free(vm2);
-	PROC_TREE_UNREF(newproc);
+	if (newproc != NULL)
+		PROC_TREE_UNREF(newproc);
 	if ((flags & RFPROCDESC) != 0 && fp_procdesc != NULL) {
 		fdclose(td, fp_procdesc, *fr->fr_pd_fd);
 		fdrop(fp_procdesc, td);