diff --git a/stack/bnep/bnep_main.c b/stack/bnep/bnep_main.c
index 6d3684e..36b76a1 100644
--- a/stack/bnep/bnep_main.c
+++ b/stack/bnep/bnep_main.c
@@ -575,6 +575,7 @@
             p_bcb->con_state != BNEP_STATE_CONNECTED &&
             extension_present && p && rem_len)
         {
+            osi_free(p_bcb->p_pending_data);
             p_bcb->p_pending_data = (BT_HDR *)osi_malloc(rem_len + sizeof(BT_HDR));
             memcpy((UINT8 *)(p_bcb->p_pending_data + 1), p, rem_len);
             p_bcb->p_pending_data->len    = rem_len;
diff --git a/stack/bnep/bnep_utils.c b/stack/bnep/bnep_utils.c
index f11c6c8..a0c8846 100644
--- a/stack/bnep/bnep_utils.c
+++ b/stack/bnep/bnep_utils.c
@@ -154,6 +154,7 @@
 
     /* Drop any response pointer we may be holding */
     p_bcb->con_state        = BNEP_STATE_IDLE;
+    osi_free(p_bcb->p_pending_data);
     p_bcb->p_pending_data   = NULL;
 
     /* Free transmit queue */