diff --git a/stack/bnep/bnep_main.cc b/stack/bnep/bnep_main.cc
index ae3480d..b0fad6a 100644
--- a/stack/bnep/bnep_main.cc
+++ b/stack/bnep/bnep_main.cc
@@ -525,6 +525,7 @@
       if (ctrl_type == BNEP_SETUP_CONNECTION_REQUEST_MSG &&
           p_bcb->con_state != BNEP_STATE_CONNECTED && extension_present && p &&
           rem_len) {
+        osi_free(p_bcb->p_pending_data);
         p_bcb->p_pending_data = (BT_HDR*)osi_malloc(rem_len + sizeof(BT_HDR));
         memcpy((uint8_t*)(p_bcb->p_pending_data + 1), p, rem_len);
         p_bcb->p_pending_data->len = rem_len;
diff --git a/stack/bnep/bnep_utils.cc b/stack/bnep/bnep_utils.cc
index 3f5e13e..f2be411 100644
--- a/stack/bnep/bnep_utils.cc
+++ b/stack/bnep/bnep_utils.cc
@@ -144,7 +144,7 @@
 
   /* Drop any response pointer we may be holding */
   p_bcb->con_state = BNEP_STATE_IDLE;
-  p_bcb->p_pending_data = NULL;
+  osi_free_and_reset((void**)&p_bcb->p_pending_data);
 
   /* Free transmit queue */
   while (!fixed_queue_is_empty(p_bcb->xmit_q)) {