diff --git a/sys/security/mac_do/mac_do.c b/sys/security/mac_do/mac_do.c
index 3d0ce2b49ba..cb351cef15c 100644
--- a/sys/security/mac_do/mac_do.c
+++ b/sys/security/mac_do/mac_do.c
@@ -1160,6 +1160,21 @@ parse_exec_paths(const char *const string, struct exec_paths *const exec_paths,
 	goto out;
 }
 
+static void
+hold_conf(struct conf *const conf)
+{
+	refcount_acquire(&conf->use_count);
+}
+
+static void
+drop_conf(struct conf *const conf)
+{
+	if (refcount_release(&conf->use_count)) {
+		toast_rules(&conf->rules);
+		free(conf, M_MAC_DO);
+	}
+}
+
 /*
  * Find configuration applicable to the passed prison.
  *
@@ -1200,21 +1215,6 @@ find_conf(struct prison *const pr, struct prison **const aprp)
 	return (conf);
 }
 
-static void
-hold_conf(struct conf *const conf)
-{
-	refcount_acquire(&conf->use_count);
-}
-
-static void
-drop_conf(struct conf *const conf)
-{
-	if (refcount_release(&conf->use_count)) {
-		toast_rules(&conf->rules);
-		free(conf, M_MAC_DO);
-	}
-}
-
 #ifdef INVARIANTS
 static void
 check_conf_use_count(const struct conf *const conf, u_int expected)