--- pf.c.fni	2018-01-26 09:47:11.833994000 +1300
+++ pf.c.fni	2018-02-09 14:22:40.966233000 +1300
@@ -804,10 +804,20 @@ 
 	V_pf_state_key_z = uma_zcreate("pf state keys",
 	    sizeof(struct pf_state_key), pf_state_key_ctor, NULL, NULL, NULL,
 	    UMA_ALIGN_PTR, 0);
-	V_pf_keyhash = malloc(pf_hashsize * sizeof(struct pf_keyhash),
+	if ((V_pf_keyhash = mallocarray(pf_hashsize, sizeof(struct pf_keyhash),
+	    M_PFHASH, M_NOWAIT | M_ZERO)) == NULL){
+	    V_pf_keyhash = mallocarray(PF_HASHSIZ, sizeof(struct pf_keyhash),
 	    M_PFHASH, M_WAITOK | M_ZERO);
-	V_pf_idhash = malloc(pf_hashsize * sizeof(struct pf_idhash),
+            printf("pf_initialize: invalid states hashtable size(%lu)\n",
+            pf_hashsize);
+        }
+	if ((V_pf_idhash = mallocarray(pf_hashsize, sizeof(struct pf_idhash),
+	    M_PFHASH, M_NOWAIT | M_ZERO)) == NULL){
+	    V_pf_idhash = mallocarray(PF_HASHSIZ, sizeof(struct pf_idhash),
 	    M_PFHASH, M_WAITOK | M_ZERO);
+            printf("pf_initialize: invalid states hashtable size(%lu)\n",
+            pf_hashsize);
+        }
 	pf_hashmask = pf_hashsize - 1;
 	for (i = 0, kh = V_pf_keyhash, ih = V_pf_idhash; i <= pf_hashmask;
 	    i++, kh++, ih++) {
@@ -822,9 +832,14 @@ 
 	V_pf_limits[PF_LIMIT_SRC_NODES].zone = V_pf_sources_z;
 	uma_zone_set_max(V_pf_sources_z, PFSNODE_HIWAT);
 	uma_zone_set_warning(V_pf_sources_z, "PF source nodes limit reached");
-	V_pf_srchash = malloc(pf_srchashsize * sizeof(struct pf_srchash),
-	  M_PFHASH, M_WAITOK|M_ZERO);
-	pf_srchashmask = pf_srchashsize - 1;
+	if ((V_pf_srchash = mallocarray(pf_srchashsize, 
+            sizeof(struct pf_srchash), M_PFHASH, M_NOWAIT | M_ZERO)) == NULL){
+	    V_pf_srchash = mallocarray((PF_HASHSIZ / 4), 
+            sizeof(struct pf_srchash), M_PFHASH, M_WAITOK | M_ZERO);
+            printf("pf_initialize: invalid source nodes hashtable size(%lu)\n",
+            pf_srchashsize);
+        }
+        pf_srchashmask = pf_srchashsize - 1;
 	for (i = 0, sh = V_pf_srchash; i <= pf_srchashmask; i++, sh++)
 		mtx_init(&sh->lock, "pf_srchash", NULL, MTX_DEF);