diff --git a/sys/netbt/rfcomm_session.c b/sys/netbt/rfcomm_session.c
--- a/sys/netbt/rfcomm_session.c
+++ b/sys/netbt/rfcomm_session.c
@@ -424,8 +424,8 @@
 	 * schedule an expiry so that if nothing comes of it we
 	 * can punt.
 	 */
-	callout_reset(&rs->rs_timeout, rfcomm_mcc_timeout * hz,
-	    rfcomm_session_timeout, rs);
+	callout_reset(&new->rs_timeout, rfcomm_mcc_timeout * hz,
+	    rfcomm_session_timeout, new);
 
 	return new->rs_l2cap;
 }