diff --git a/sys/dev/disk/iscsi/initiator/isc_sm.c b/sys/dev/disk/iscsi/initiator/isc_sm.c
--- a/sys/dev/disk/iscsi/initiator/isc_sm.c
+++ b/sys/dev/disk/iscsi/initiator/isc_sm.c
@@ -529,8 +529,13 @@
 
 	  if((error = isc_sendPDU(sp, pq)) == 0) {
 	       ndone++;
-	       if(pq->ccb == NULL)
-		    pdu_free(sp->isc, pq);
+	       /* isc_sendPDU may have queued mbufs that reference pq via
+		* m_ext.ext_arg/ext_free; freeing pq here would UAF once ext_free
+		* runs after the peer ACKs. */
+	       if(pq->ccb == NULL) {
+		    if (pq->refcnt == 0)
+			 pdu_free(sp->isc, pq);
+	       }
 	  }
 	  else {
 	       xdebug("error=%d ndone=%d opcode=0x%x ccb=%p itt=%x",