diff --git a/sys/dev/disk/iscsi/initiator/isc_sm.c b/sys/dev/disk/iscsi/initiator/isc_sm.c
--- a/sys/dev/disk/iscsi/initiator/isc_sm.c
+++ b/sys/dev/disk/iscsi/initiator/isc_sm.c
@@ -529,8 +529,14 @@
 
 	  if((error = isc_sendPDU(sp, pq)) == 0) {
 	       ndone++;
-	       if(pq->ccb == NULL)
-		    pdu_free(sp->isc, pq);
+	       /* Don't free ccb-less PDUs immediately: under USE_MBUF the DS mbufs
+		* hold an ext_arg reference to pq that survives in the socket send
+		* buffer until ACK. Queue on the in-flight list and let the ACK path
+		* (or session teardown) free them. */
+	       if(pq->ccb == NULL) {
+		    pq->refcnt++;
+		    i_nqueue_hld(sp, pq);
+	       }
 	  }
 	  else {
 	       xdebug("error=%d ndone=%d opcode=0x%x ccb=%p itt=%x",