diff --git a/sys/netgraph7/bluetooth/drivers/ubt/ng_ubt.c b/sys/netgraph7/bluetooth/drivers/ubt/ng_ubt.c
--- a/sys/netgraph7/bluetooth/drivers/ubt/ng_ubt.c
+++ b/sys/netgraph7/bluetooth/drivers/ubt/ng_ubt.c
@@ -1172,6 +1172,16 @@
 
 		ubt_fwd_mbuf_up(sc, &m);
 		/* m == NULL at this point */
+		/*
+		 * DF-0420: the buffer has been handed off (and freed/queued).
+		 * NULL the field NOW so that a later MGETHDR/MCLGET failure
+		 * in this loop (return -1) cannot leave sc_isoc_in_buffer
+		 * pointing at the just-freed mbuf -- which the next callback
+		 * would dereference (UAF read of m_pkthdr.len / UAF write
+		 * via usbd_copy_out). Line below then keeps it NULL or sets
+		 * it to a fresh partial buffer as appropriate.
+		 */
+		sc->sc_isoc_in_buffer = NULL;
 	}
 
 	/* Put SCO reassembly buffer back */