--- sys/kern/kern_event.c.orig
+++ sys/kern/kern_event.c
@@ -3085,9 +3085,9 @@
 	    ("%s: knote %p not in flux", __func__, kn));
 	KASSERT((kn->kn_status & KN_DETACHED) == 0,
 	    ("%s: knote %p not detached", __func__, kn));
+	KASSERT((kn->kn_status & KN_MARKER) == 0,
+	    ("%s: knote %p not detached", __func__, kn));
 
-	if ((kn->kn_status & KN_MARKER) != 0)
-		return;
 	if ((kn->kn_status & KN_KQUEUE) != 0) {
 		/*
 		 * We cannot hold references to a kqueue outside of the process
@@ -3097,7 +3097,8 @@
 	}
 	fop = kn->kn_fop;
 	if (fop->f_copy == NULL || (fop->f_isfd &&
-	    fdp->fd_files->fdt_ofiles[kn->kn_kevent.ident].fde_file == NULL))
+	    ((unsigned int)fdp->fd_files->fdt_nfiles <= kn->kn_kevent.ident ||
+	    fdp->fd_files->fdt_ofiles[kn->kn_kevent.ident].fde_file == NULL)))
 		return;
 	error = kqueue_expand(kq1, fop, kn->kn_kevent.ident, M_WAITOK);
 	if (error != 0)
@@ -3153,7 +3154,7 @@
 	kn = SLIST_FIRST(knlist);
 	while (kn != NULL) {
 		MPASS(kn->kn_kq == kq);
-		if ((kn->kn_status & KN_DETACHED) != 0 ||
+		if ((kn->kn_status & (KN_DETACHED | KN_MARKER)) != 0 ||
 		    (kn_in_flux(kn) && (kn->kn_status & KN_SCAN) == 0)) {
 			kn = SLIST_NEXT(kn, kn_link);
 			continue;