diff --git a/sys/contrib/subrepo-openzfs/.gitrepo b/sys/contrib/subrepo-openzfs/.gitrepo
index b5c9528e4428..702e8b601311 100644
--- a/sys/contrib/subrepo-openzfs/.gitrepo
+++ b/sys/contrib/subrepo-openzfs/.gitrepo
@@ -6,7 +6,7 @@
 [subrepo]
 	remote = https://github.com/CTSRD-CHERI/zfs.git
 	branch = cheri-hybrid
-	commit = 883fa85588eae47c4a66dd2a90f468077d7c765c
-	parent = 4fb5dcc15f7ce879d85ac4ef0c8f81e9dd3c8802
+	commit = 44c138489e5175af9d099ea82d8a9fb51fdbcbd8
+	parent = 81f320de80d335dd7f7777c05b9b528c0aeebf57
 	method = merge
 	cmdver = 0.4.6
diff --git a/sys/contrib/subrepo-openzfs/lib/libzpool/kernel.c b/sys/contrib/subrepo-openzfs/lib/libzpool/kernel.c
index ffad7fc02bc9..0f1655836b20 100644
--- a/sys/contrib/subrepo-openzfs/lib/libzpool/kernel.c
+++ b/sys/contrib/subrepo-openzfs/lib/libzpool/kernel.c
@@ -132,7 +132,9 @@ zk_thread_create(void (*func)(void *), void *arg, size_t stksize, int state)
 	 * multiple of system page size.
 	 */
 	VERIFY0(pthread_attr_setstacksize(&attr, stksize));
+#ifndef __CHERI_PURE_CAPABILITY__
 	VERIFY0(pthread_attr_setguardsize(&attr, PAGESIZE));
+#endif
 
 	VERIFY(ztw = malloc(sizeof (*ztw)));
 	ztw->func = func;
diff --git a/sys/contrib/subrepo-openzfs/module/nvpair/nvpair.c b/sys/contrib/subrepo-openzfs/module/nvpair/nvpair.c
index 47fd1b0fd6f2..a054a6376ca9 100644
--- a/sys/contrib/subrepo-openzfs/module/nvpair/nvpair.c
+++ b/sys/contrib/subrepo-openzfs/module/nvpair/nvpair.c
@@ -55,7 +55,7 @@
 
 #define	skip_whitespace(p)	while ((*(p) == ' ') || (*(p) == '\t')) (p)++
 
-#ifdef __CHERI_PURE_CAPABILITY__
+#if __has_feature(capabilities)
 #define NVPAIR_OVER_ALLOCATE_DECODE
 #endif
 
diff --git a/sys/contrib/subrepo-openzfs/module/zfs/dbuf.c b/sys/contrib/subrepo-openzfs/module/zfs/dbuf.c
index 324bf8cbc276..174784b2ee77 100644
--- a/sys/contrib/subrepo-openzfs/module/zfs/dbuf.c
+++ b/sys/contrib/subrepo-openzfs/module/zfs/dbuf.c
@@ -2856,6 +2856,7 @@ dmu_buf_fill_done(dmu_buf_t *dbuf, dmu_tx_t *tx, boolean_t failed)
 			failed = B_FALSE;
 		} else if (failed) {
 			VERIFY(!dbuf_undirty(db, tx));
+			arc_buf_destroy(db->db_buf, db);
 			db->db_buf = NULL;
 			dbuf_clear_data(db);
 			DTRACE_SET_STATE(db, "fill failed");