diff --git a/sys/netipsec/key.c b/sys/netipsec/key.c
index 7a57a315c87..3c320cec116 100644
--- a/sys/netipsec/key.c
+++ b/sys/netipsec/key.c
@@ -5100,7 +5100,7 @@ key_updateaddresses(struct socket *so, struct mbuf *m,
 	newsav->natt = NULL;
 	newsav->sah = sah;
 	newsav->state = SADB_SASTATE_MATURE;
-	error = key_setnatt(sav, mhp);
+	error = key_setnatt(newsav, mhp);
 	if (error != 0)
 		goto fail;