diff -r 85624db56a91 -r 1f2fdc9305f6 sys/netinet/tcp_reass.c
--- a/sys/netinet/tcp_reass.c	Sun Aug 08 17:24:40 2010 +1000
+++ b/sys/netinet/tcp_reass.c	Sun Aug 08 17:42:16 2010 +1000
@@ -134,6 +134,25 @@
 }
 #endif
 
+void
+tcp_reass_flush(struct tsegq *t_segq)
+{
+	struct tseg_qent *qe;
+
+	while ((qe = LIST_FIRST(t_segq)) != NULL) {
+		LIST_REMOVE(qe, tqe_q);
+		m_freem(qe->tqe_m);
+		uma_zfree(V_tcp_reass_zone, qe);
+		t_segq->tsegq_mbufs--;
+		V_tcp_reass_qsize--;
+	}
+
+	KASSERT((t_segq->tsegq_mbufs == 0),
+	    ("TCP reass queue %p mbuf count is %d instead of 0 after flush.",
+	    t_segq, t_segq->tsegq_mbufs));
+
+}
+
 int
 tcp_reass(struct tcpcb *tp, struct tcphdr *th, int *tlenp, struct mbuf *m)
 {
diff -r 85624db56a91 -r 1f2fdc9305f6 sys/netinet/tcp_subr.c
--- a/sys/netinet/tcp_subr.c	Sun Aug 08 17:24:40 2010 +1000
+++ b/sys/netinet/tcp_subr.c	Sun Aug 08 17:42:16 2010 +1000
@@ -769,7 +769,6 @@
 void
 tcp_discardcb(struct tcpcb *tp)
 {
-	struct tseg_qent *q;
 	struct inpcb *inp = tp->t_inpcb;
 	struct socket *so = inp->inp_socket;
 #ifdef INET6
@@ -858,13 +857,7 @@
 	}
 
 	/* free the reassembly queue, if any */
-	while ((q = LIST_FIRST(tp->t_segq)) != NULL) {
-		LIST_REMOVE(q, tqe_q);
-		m_freem(q->tqe_m);
-		uma_zfree(V_tcp_reass_zone, q);
-		tp->t_segq->tsegq_mbufs--;
-		V_tcp_reass_qsize--;
-	}
+	tcp_reass_flush(tp->t_segq);
 	/* Disconnect offload device, if any. */
 	tcp_offload_detach(tp);
 		
@@ -922,7 +915,6 @@
 		CURVNET_SET(vnet_iter);
 		struct inpcb *inpb;
 		struct tcpcb *tcpb;
-		struct tseg_qent *te;
 
 	/*
 	 * Walk the tcpbs, if existing, and flush the reassembly queue,
@@ -938,14 +930,7 @@
 				continue;
 			INP_WLOCK(inpb);
 			if ((tcpb = intotcpcb(inpb)) != NULL) {
-				while ((te = LIST_FIRST(tcpb->t_segq))
-			            != NULL) {
-					LIST_REMOVE(te, tqe_q);
-					m_freem(te->tqe_m);
-					uma_zfree(V_tcp_reass_zone, te);
-					tcpb->t_segq->tsegq_mbufs--;
-					V_tcp_reass_qsize--;
-				}
+				tcp_reass_flush(tcpb->t_segq);
 				tcp_clean_sackreport(tcpb);
 			}
 			INP_WUNLOCK(inpb);
diff -r 85624db56a91 -r 1f2fdc9305f6 sys/netinet/tcp_var.h
--- a/sys/netinet/tcp_var.h	Sun Aug 08 17:24:40 2010 +1000
+++ b/sys/netinet/tcp_var.h	Sun Aug 08 17:42:16 2010 +1000
@@ -615,6 +615,7 @@
 	    const void *);
 int	 tcp_reass(struct tcpcb *, struct tcphdr *, int *, struct mbuf *);
 void	 tcp_reass_init(void);
+void	 tcp_reass_flush(struct tsegq *t_segq);
 #ifdef VIMAGE
 void	 tcp_reass_destroy(void);
 #endif