diff --git a/sys/net/if_veb.c b/sys/net/if_veb.c
index b6e409e09e0..ee3e9c17bc3 100644
--- a/sys/net/if_veb.c
+++ b/sys/net/if_veb.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: if_veb.c,v 1.57 2025/11/26 01:43:56 dlg Exp $ */
+/*	$OpenBSD: if_veb.c,v 1.58 2025/11/26 02:13:54 dlg Exp $ */
 
 /*
  * Copyright (c) 2021 David Gwynne <dlg@openbsd.org>
@@ -1251,7 +1251,7 @@ veb_port_input(struct ifnet *ifp0, struct mbuf *m, uint64_t dst, void *brport,
 		goto drop;
 
 #if NPF > 0
-	if (ISSET(ifp->if_flags, IFF_LINK1) && p->p_pvid == ctx->vs &&
+	if (ISSET(ifp->if_flags, IFF_LINK1) && p->p_pvid == ctx.vs &&
 	    (m = veb_pf(ifp0, PF_IN, m, ctx.ns)) == NULL)
 		return (NULL);
 #endif
@@ -3354,6 +3354,7 @@ static int
 vport_if_enqueue(struct ifnet *ifp, struct mbuf *m, struct netstack *ns)
 {
 	uint16_t csum;
+	int rv = 0;
 
 	/*
 	 * switching an l2 packet toward a vport means pushing it
@@ -3373,9 +3374,22 @@ vport_if_enqueue(struct ifnet *ifp, struct mbuf *m, struct netstack *ns)
 		SET(csum, M_ICMP_CSUM_IN_OK);
 	m->m_pkthdr.csum_flags = csum;
 
-	if_vinput(ifp, m, ns);
+	if (ns != NULL) {
+		/* this is already running in a softnet context */
+		if_vinput(ifp, m, ns);
+	} else {
+		/* move the packet to a softnet context for processing */
+		struct ifiqueue *ifiq;
+		unsigned int flow = 0;
 
-	return (0);
+		if (ISSET(m->m_pkthdr.csum_flags, M_FLOWID))
+			flow = m->m_pkthdr.ph_flowid;
+
+		ifiq = ifp->if_iqs[flow % ifp->if_niqs];
+		rv = ifiq_enqueue_qlim(ifiq, m, 8192);
+	}
+
+	return (rv);
 }
 
 static int