diff --git a/module/include/pfk.h b/module/include/pfk.h
index b3152f8..34d55b9 100644
--- a/module/include/pfk.h
+++ b/module/include/pfk.h
@@ -1277,8 +1277,15 @@ struct hfsc_class_stats {
 #define tick_nsec		(1000000000LL / HZ)
 #endif
 
-#define HFSC_ROOT_CLASS		0x1		/* root class of the tree */
-#define HFSC_DEFAULTCLASS	0x8		/* auto-created default class */
+/*
+ * Class-handle namespace.  pf queue ids are u_int16_t, so the root class gets
+ * a high bit that can never collide with a queue handle (a collision made
+ * hfsc_pf_addqueue() see the root class as a duplicate and refuse the queue
+ * with EBUSY).  HFSC_DEFAULTCLASS must equal PFQS_DEFAULT because hfsc.c
+ * receives the pf queue flags verbatim.
+ */
+#define HFSC_ROOT_CLASS		0x80000000u
+#define HFSC_DEFAULTCLASS	0x1000
 #define HFSC_MAX_CLASSES	64
 #define HFSC_DEFAULT_CLASSES	8
 #define HFSC_DEFAULT_QLIMIT	1000
diff --git a/module/pfsrc/pf_ioctl.c b/module/pfsrc/pf_ioctl.c
index d73c7e9..4a20ca6 100644
--- a/module/pfsrc/pf_ioctl.c
+++ b/module/pfsrc/pf_ioctl.c
@@ -662,6 +662,11 @@ pf_create_queues(void)
 		}
 
 		qif->disc = qif->pfqops->pfq_alloc(ifp);
+		if (qif->disc == NULL) {
+			error = ENOBUFS;
+			free(qif, M_PF, sizeof(*qif));
+			goto error;
+		}
 
 		qif->next = list;
 		list = qif;