diff --git a/sys/rpc/rpcsec_tls/rpctls_impl.c b/sys/rpc/rpcsec_tls/rpctls_impl.c
--- a/sys/rpc/rpcsec_tls/rpctls_impl.c
+++ b/sys/rpc/rpcsec_tls/rpctls_impl.c
@@ -181,6 +181,12 @@
 		return (EPERM);
 	}
 	if ((error = falloc(td, &fp, &fd, 0)) != 0) {
+		/*
+		 * The socket will not be acquired by the daemon,
+		 * but has been removed from the upcall socket RB.
+		 * As such, it needs to be closed here.
+		 */
+		soclose(ups.so);
 		KRPC_CURVNET_RESTORE();
 		return (error);
 	}
@@ -223,13 +229,11 @@
 		mtx_unlock(&rpctls_lock);
 		MPASS(removed == ups);
 		/*
-		 * Do a shutdown on the socket, since the daemon is
-		 * probably stuck in SSL_accept() trying to read the
-		 * socket.  Do not soclose() the socket, since the
-		 * daemon will close() the socket after SSL_accept()
-		 * returns an error.
+		 * Since the socket was still in the RB tree when
+		 * this function was called, the daemon will not
+		 * close it.  As such, it needs to be closed here.
 		 */
-		soshutdown(so, SHUT_RD);
+		soclose(so);
 	} else {
 		/*
 		 * The daemon has taken the socket from the tree, but