diff --git a/sys/netpfil/pf/pf.c b/sys/netpfil/pf/pf.c
index cfab6a828d5..7b0ee24965b 100644
--- a/sys/netpfil/pf/pf.c
+++ b/sys/netpfil/pf/pf.c
@@ -7149,6 +7149,9 @@ pf_test_state_sctp(struct pf_kstate **state, struct pf_pdesc *pd,
 		return (PF_DROP);
 	}
 
+	if (pf_sctp_track(*state, pd, reason) != PF_PASS)
+		return (PF_DROP);
+
 	/* Track state. */
 	if (pd->sctp_flags & PFDESC_SCTP_INIT) {
 		if (src->state < SCTP_COOKIE_WAIT) {
@@ -7180,9 +7183,6 @@ pf_test_state_sctp(struct pf_kstate **state, struct pf_pdesc *pd,
 		(*state)->timeout = PFTM_SCTP_CLOSED;
 	}
 
-	if (pf_sctp_track(*state, pd, reason) != PF_PASS)
-		return (PF_DROP);
-
 	(*state)->expire = pf_get_uptime();
 
 	/* translate source/destination address, if necessary */