Index: sys/netpfil/pf/pf.c
===================================================================
--- sys/netpfil/pf/pf.c	(revision 256398)
+++ sys/netpfil/pf/pf.c	(working copy)
@@ -819,6 +819,9 @@ pf_mtag_init(void *mem, int size, int how)
 	t->m_tag_id = PACKET_TAG_PF;
 	t->m_tag_len = sizeof(struct pf_mtag);
 	t->m_tag_free = pf_mtag_free;
+#ifdef VIMAGE
+	t->m_tag_vnet = curvnet;
+#endif
 
 	return (0);
 }
@@ -827,7 +830,9 @@ static void
 pf_mtag_free(struct m_tag *t)
 {
 
+	CURVNET_SET(t->m_tag_vnet);
 	uma_zfree(V_pf_mtag_z, t);
+	CURVNET_RESTORE();
 }
 
 struct pf_mtag *
Index: sys/sys/mbuf.h
===================================================================
--- sys/sys/mbuf.h	(revision 256398)
+++ sys/sys/mbuf.h	(working copy)
@@ -43,6 +43,9 @@
 #include <sys/lock.h>
 #endif
 #endif
+#ifdef VIMAGE
+#include <sys/vnet.h>
+#endif
 
 /*
  * Mbufs are of a single size, MSIZE (sys/param.h), which includes overhead.
@@ -112,6 +115,9 @@ struct m_tag {
 	u_int16_t		m_tag_len;	/* Length of data */
 	u_int32_t		m_tag_cookie;	/* ABI/Module ID */
 	void			(*m_tag_free)(struct m_tag *);
+#ifdef VIMAGE
+	vnet			*m_tag_vnet;	/* vnet context */
+#endif
 };
 
 /*