diff --git a/sys/netinet/tcp_input.c b/sys/netinet/tcp_input.c
index 62ccb3bd138..2658d592df4 100644
--- a/sys/netinet/tcp_input.c
+++ b/sys/netinet/tcp_input.c
@@ -796,6 +796,9 @@ findpcb:
 	if (so->so_options & SO_ACCEPTCONN) {
 		struct in_conninfo inc;
 
+		KASSERT(tp->t_state == TCPS_LISTEN, ("%s: so accepting but "
+		    "tp not listening", __func__));
+
 		bzero(&inc, sizeof(inc));
 		inc.inc_isipv6 = isipv6;
 #ifdef INET6
@@ -2519,6 +2522,7 @@ dodata:							/* XXX */
 check_delack:
 	KASSERT(headlocked == 0, ("%s: check_delack: head locked",
 	    __func__));
+	INP_INFO_UNLOCK_ASSERT(&tcbinfo);
 	INP_LOCK_ASSERT(tp->t_inpcb);
 	if (tp->t_flags & TF_DELACK) {
 		tp->t_flags &= ~TF_DELACK;
diff --git a/sys/netinet/tcp_reass.c b/sys/netinet/tcp_reass.c
index 62ccb3bd138..2658d592df4 100644
--- a/sys/netinet/tcp_reass.c
+++ b/sys/netinet/tcp_reass.c
@@ -796,6 +796,9 @@ findpcb:
 	if (so->so_options & SO_ACCEPTCONN) {
 		struct in_conninfo inc;
 
+		KASSERT(tp->t_state == TCPS_LISTEN, ("%s: so accepting but "
+		    "tp not listening", __func__));
+
 		bzero(&inc, sizeof(inc));
 		inc.inc_isipv6 = isipv6;
 #ifdef INET6
@@ -2519,6 +2522,7 @@ dodata:							/* XXX */
 check_delack:
 	KASSERT(headlocked == 0, ("%s: check_delack: head locked",
 	    __func__));
+	INP_INFO_UNLOCK_ASSERT(&tcbinfo);
 	INP_LOCK_ASSERT(tp->t_inpcb);
 	if (tp->t_flags & TF_DELACK) {
 		tp->t_flags &= ~TF_DELACK;