diff --git a/sys/net/bpf.c b/sys/net/bpf.c
index 8ca6e941e646..038cb8b7d366 100644
--- a/sys/net/bpf.c
+++ b/sys/net/bpf.c
@@ -100,10 +100,6 @@
 
 MALLOC_DEFINE(M_BPF, "BPF", "BPF data");
 
-static struct bpf_if_ext dead_bpf_if = {
-	.bif_dlist = CK_LIST_HEAD_INITIALIZER()
-};
-
 struct bpf_if {
 #define	bif_next	bif_ext.bif_next
 #define	bif_dlist	bif_ext.bif_dlist
@@ -112,13 +108,17 @@ struct bpf_if {
 	u_int		bif_hdrlen;	/* length of link header */
 	struct bpfd_list bif_wlist;	/* writer-only list */
 	struct ifnet	*bif_ifp;	/* corresponding interface */
-	struct bpf_if	**bif_bpf;	/* Pointer to pointer to us */
+	const struct bpf_if	**bif_bpf;	/* Pointer to pointer to us */
 	volatile u_int	bif_refcnt;
 	struct epoch_context epoch_ctx;
 };
 
 CTASSERT(offsetof(struct bpf_if, bif_ext) == 0);
 
+static const struct bpf_if dead_bpf_if = {
+	.bif_dlist = CK_LIST_HEAD_INITIALIZER()
+};
+
 struct bpf_program_buffer {
 	struct epoch_context	epoch_ctx;
 #ifdef BPF_JITTER
@@ -2095,7 +2095,8 @@ bpf_setif(struct bpf_d *d, struct ifreq *ifr)
 	if (theywant == NULL || theywant->if_bpf == NULL)
 		return (ENXIO);
 
-	bp = theywant->if_bpf;
+	bp = __DECONST(struct bpf_if *, theywant->if_bpf);
+
 	/*
 	 * At this point, we expect the buffer is already allocated.  If not,
 	 * return an error.
@@ -2299,7 +2300,7 @@ bpf_gettime(struct bintime *bt, int tstype, struct mbuf *m)
  * buffer.
  */
 void
-bpf_tap(struct bpf_if *bp, u_char *pkt, u_int pktlen)
+bpf_tap(const struct bpf_if *bp, u_char *pkt, u_int pktlen)
 {
 	struct epoch_tracker et;
 	struct bintime bt;
@@ -2363,7 +2364,7 @@ bpf_tap_if(if_t ifp, u_char *pkt, u_int pktlen)
  * Locking model is explained in bpf_tap().
  */
 void
-bpf_mtap(struct bpf_if *bp, struct mbuf *m)
+bpf_mtap(const struct bpf_if *bp, struct mbuf *m)
 {
 	struct epoch_tracker et;
 	struct bintime bt;
@@ -2428,7 +2429,7 @@ bpf_mtap_if(if_t ifp, struct mbuf *m)
  * an mbuf chain and to be prepended by a contiguous header.
  */
 void
-bpf_mtap2(struct bpf_if *bp, void *data, u_int dlen, struct mbuf *m)
+bpf_mtap2(const struct bpf_if *bp, void *data, u_int dlen, struct mbuf *m)
 {
 	struct epoch_tracker et;
 	struct bintime bt;
@@ -2785,7 +2786,7 @@ bpfattach(struct ifnet *ifp, u_int dlt, u_int hdrlen)
  */
 void
 bpfattach2(struct ifnet *ifp, u_int dlt, u_int hdrlen,
-    struct bpf_if **driverp)
+    const struct bpf_if **driverp)
 {
 	struct bpf_if *bp;
 
@@ -2824,7 +2825,7 @@ bpfattach2(struct ifnet *ifp, u_int dlt, u_int hdrlen,
  * add this as a workaround.
  */
 int
-bpf_get_bp_params(struct bpf_if *bp, u_int *bif_dlt, u_int *bif_hdrlen)
+bpf_get_bp_params(const struct bpf_if *bp, u_int *bif_dlt, u_int *bif_hdrlen)
 {
 
 	if (bp == NULL)
@@ -2859,7 +2860,7 @@ bpfdetach(struct ifnet *ifp)
 			continue;
 
 		CK_LIST_REMOVE(bp, bif_next);
-		*bp->bif_bpf = (struct bpf_if *)&dead_bpf_if;
+		*bp->bif_bpf = &dead_bpf_if;
 
 		CTR4(KTR_NET,
 		    "%s: sheduling free for encap %d (%p) for if %p",
@@ -3151,10 +3152,11 @@ bpfattach(struct ifnet *ifp, u_int dlt, u_int hdrlen)
 }
 
 void
-bpfattach2(struct ifnet *ifp, u_int dlt, u_int hdrlen, struct bpf_if **driverp)
+bpfattach2(struct ifnet *ifp, u_int dlt, u_int hdrlen,
+    const struct bpf_if **driverp)
 {
 
-	*driverp = (struct bpf_if *)&dead_bpf_if;
+	*driverp = &dead_bpf_if;
 }
 
 void
diff --git a/sys/net/bpf.h b/sys/net/bpf.h
index 924dea5fc9f4..f8fda202fa42 100644
--- a/sys/net/bpf.h
+++ b/sys/net/bpf.h
@@ -419,28 +419,28 @@ struct bpf_if_ext {
 
 void	 bpf_bufheld(struct bpf_d *d);
 int	 bpf_validate(const struct bpf_insn *, int);
-void	 bpf_tap(struct bpf_if *, u_char *, u_int);
+void	 bpf_tap(const struct bpf_if *, u_char *, u_int);
 void	 bpf_tap_if(struct ifnet *, u_char *, u_int);
-void	 bpf_mtap(struct bpf_if *, struct mbuf *);
+void	 bpf_mtap(const struct bpf_if *, struct mbuf *);
 void	 bpf_mtap_if(struct ifnet *, struct mbuf *);
-void	 bpf_mtap2(struct bpf_if *, void *, u_int, struct mbuf *);
+void	 bpf_mtap2(const struct bpf_if *, void *, u_int, struct mbuf *);
 void	 bpf_mtap2_if(struct ifnet *, void *, u_int, struct mbuf *);
 void	 bpfattach(struct ifnet *, u_int, u_int);
-void	 bpfattach2(struct ifnet *, u_int, u_int, struct bpf_if **);
+void	 bpfattach2(struct ifnet *, u_int, u_int, const struct bpf_if **);
 void	 bpfdetach(struct ifnet *);
 #ifdef VIMAGE
-int	 bpf_get_bp_params(struct bpf_if *, u_int *, u_int *);
+int	 bpf_get_bp_params(const struct bpf_if *, u_int *, u_int *);
 #endif
 
 void	 bpfilterattach(int);
 u_int	 bpf_filter(const struct bpf_insn *, u_char *, u_int, u_int);
 
 static __inline int
-bpf_peers_present(struct bpf_if *bpf)
+bpf_peers_present(const struct bpf_if *bpf)
 {
-	struct bpf_if_ext *ext;
+	const struct bpf_if_ext *ext;
 
-	ext = (struct bpf_if_ext *)bpf;
+	ext = (const struct bpf_if_ext *)bpf;
 	if (!CK_LIST_EMPTY(&ext->bif_dlist))
 		return (1);
 	return (0);
diff --git a/sys/net/ethernet.h b/sys/net/ethernet.h
index fca6748a0da7..0561ee781790 100644
--- a/sys/net/ethernet.h
+++ b/sys/net/ethernet.h
@@ -442,7 +442,7 @@ extern	int  ether_output(struct ifnet *, struct mbuf *,
 	    const struct sockaddr *, struct route *);
 extern	int  ether_output_frame(struct ifnet *, struct mbuf *);
 extern	char *ether_sprintf(const u_int8_t *);
-void	ether_vlan_mtap(struct bpf_if *, struct mbuf *,
+void	ether_vlan_mtap(const struct bpf_if *, struct mbuf *,
 	    void *, u_int);
 struct mbuf  *ether_vlanencap_proto(struct mbuf *, uint16_t, uint16_t);
 bool	ether_8021q_frame(struct mbuf **mp, struct ifnet *ife,
diff --git a/sys/net/if.c b/sys/net/if.c
index f7636d46331a..f20f58e674fb 100644
--- a/sys/net/if.c
+++ b/sys/net/if.c
@@ -5145,7 +5145,7 @@ if_getaddrlen(if_t ifp)
 	return (ifp->if_addrlen);
 }
 
-struct bpf_if *
+const struct bpf_if *
 if_getbpf(if_t ifp)
 {
 	return (ifp->if_bpf);
diff --git a/sys/net/if_ethersubr.c b/sys/net/if_ethersubr.c
index 2cbe0ea98f27..cb08a78c7a98 100644
--- a/sys/net/if_ethersubr.c
+++ b/sys/net/if_ethersubr.c
@@ -1296,7 +1296,7 @@ static moduledata_t ether_mod = {
 };
 
 void
-ether_vlan_mtap(struct bpf_if *bp, struct mbuf *m, void *data, u_int dlen)
+ether_vlan_mtap(const struct bpf_if *bp, struct mbuf *m, void *data, u_int dlen)
 {
 	struct ether_vlan_header vlan;
 	struct mbuf mv, mb;
diff --git a/sys/net/if_private.h b/sys/net/if_private.h
index 8802b08c6a05..cb2b2e5c4669 100644
--- a/sys/net/if_private.h
+++ b/sys/net/if_private.h
@@ -111,7 +111,7 @@ struct ifnet {
 	struct	vnet *if_vnet;		/* pointer to network stack instance */
 	struct	vnet *if_home_vnet;	/* where this ifnet originates from */
 	struct  ifvlantrunk *if_vlantrunk; /* pointer to 802.1q data */
-	struct	bpf_if *if_bpf;		/* packet filter structure */
+	const struct bpf_if *if_bpf;	/* packet filter structure */
 	int	if_pcount;		/* number of promiscuous listeners */
 	void	*if_bridge;		/* bridge glue */
 	void	*if_lagg;		/* lagg glue */
diff --git a/sys/net/if_var.h b/sys/net/if_var.h
index ba37a98c96fb..698ca5081d9d 100644
--- a/sys/net/if_var.h
+++ b/sys/net/if_var.h
@@ -637,7 +637,7 @@ int if_resolvemulti(if_t ifp, struct sockaddr **, struct sockaddr *);
 uint64_t if_getcounter(if_t ifp, ift_counter counter);
 struct label *if_getmaclabel(if_t ifp);
 void if_setmaclabel(if_t ifp, struct label *label);
-struct bpf_if *if_getbpf(if_t ifp);
+const struct bpf_if *if_getbpf(if_t ifp);
 uint8_t if_getpcp(if_t ifp);
 void *if_getl2com(if_t ifp);
 struct ifvlantrunk *if_getvlantrunk(if_t ifp);
diff --git a/sys/net80211/ieee80211_var.h b/sys/net80211/ieee80211_var.h
index 2fd46278d7ea..cccf6829ec6e 100644
--- a/sys/net80211/ieee80211_var.h
+++ b/sys/net80211/ieee80211_var.h
@@ -389,7 +389,7 @@ struct ieee80211_tx_histogram;
 struct ieee80211vap {
 	struct ifmedia		iv_media;	/* interface media config */
 	struct ifnet		*iv_ifp;	/* associated device */
-	struct bpf_if		*iv_rawbpf;	/* packet filter structure */
+	const struct bpf_if	*iv_rawbpf;	/* packet filter structure */
 	struct sysctl_ctx_list	*iv_sysctl;	/* dynamic sysctl context */
 	struct sysctl_oid	*iv_oid;	/* net.wlan.X sysctl oid */