diff --git a/sys/kern/subr_counter.c b/sys/kern/subr_counter.c
index fec51b6b635a..4dbcc34ea0e8 100644
--- a/sys/kern/subr_counter.c
+++ b/sys/kern/subr_counter.c
@@ -50,6 +50,15 @@ counter_u64_zero(counter_u64_t c)
 	counter_u64_zero_inline(c);
 }
 
+void
+counter_u64_zero_protected(counter_u64_t c)
+{
+	int cpu;
+
+	CPU_FOREACH(cpu)
+		*(zpcpu_get_cpu(c, cpu)) = 0;
+}
+
 uint64_t
 counter_u64_fetch(counter_u64_t c)
 {
diff --git a/sys/netpfil/pf/pf_table.c b/sys/netpfil/pf/pf_table.c
index ac457b592443..3721313785fd 100644
--- a/sys/netpfil/pf/pf_table.c
+++ b/sys/netpfil/pf/pf_table.c
@@ -940,9 +940,9 @@ pfr_clstats_kentries(struct pfr_kentryworkq *workq, long tzero, int negchange)
 			p->pfrke_not = !p->pfrke_not;
 		for (pfr_dir = 0; pfr_dir < PFR_DIR_MAX; pfr_dir ++) {
 			for (pfr_op = 0; pfr_op < PFR_OP_ADDR_MAX; pfr_op ++) {
-				counter_u64_zero(p->pfrke_counters.
+				counter_u64_zero_protected(p->pfrke_counters.
 					pfrkc_packets[pfr_dir][pfr_op]);
-				counter_u64_zero(p->pfrke_counters.
+				counter_u64_zero_protected(p->pfrke_counters.
 					pfrkc_bytes[pfr_dir][pfr_op]);
 			}
 		}
diff --git a/sys/sys/counter.h b/sys/sys/counter.h
index 3e1b7828d5d4..05d7dc3977a4 100644
--- a/sys/sys/counter.h
+++ b/sys/sys/counter.h
@@ -40,6 +40,7 @@ counter_u64_t	counter_u64_alloc(int);
 void		counter_u64_free(counter_u64_t);
 
 void		counter_u64_zero(counter_u64_t);
+void		counter_u64_zero_protected(counter_u64_t);
 uint64_t	counter_u64_fetch(counter_u64_t);
 
 #define	COUNTER_ARRAY_ALLOC(a, n, wait)	do {			\