diff --git a/src/detection/memory/memory_nbsd.c b/src/detection/memory/memory_nbsd.c
index ca094755e..0d5ee2ff7 100644
--- a/src/detection/memory/memory_nbsd.c
+++ b/src/detection/memory/memory_nbsd.c
@@ -11,8 +11,12 @@ const char* ffDetectMemory(FFMemoryResult* ram) {
         return "sysctl(CTL_VM, VM_UVMEXP2) failed";
     }
 
+    int64_t bytesArc = ffSysctlGetInt64("kstat.zfs.misc.arcstats.size", 0);
+    if (bytesArc > 0) bytesArc -= ffSysctlGetInt64("kstat.zfs.misc.arcstats.c_min", 0);
+    if (bytesArc < 0) bytesArc = 0;
+
     ram->bytesTotal = (uint64_t) buf.npages * instance.state.platform.sysinfo.pageSize;
-    ram->bytesUsed = ((uint64_t) buf.active + (uint64_t) buf.inactive + (uint64_t) buf.wired) * instance.state.platform.sysinfo.pageSize;
+    ram->bytesUsed = ((uint64_t) buf.active + (uint64_t) buf.inactive + (uint64_t) buf.wired) * instance.state.platform.sysinfo.pageSize - (uint64_t) bytesArc;
 
     return NULL;
 }