--- a/sys/netgraph7/bluetooth/drivers/ubt/ng_ubt.c
+++ b/sys/netgraph7/bluetooth/drivers/ubt/ng_ubt.c
@@ in ubt_detach(), after destroying the queues:
 	/* Destroy queues */
 	UBT_NG_LOCK(sc);
 	NG_BT_MBUFQ_DESTROY(&sc->sc_cmdq);
 	NG_BT_MBUFQ_DESTROY(&sc->sc_aclq);
 	NG_BT_MBUFQ_DESTROY(&sc->sc_scoq);
+	NG_FREE_M(sc->sc_isoc_in_buffer);	/* partial SCO reassembly */
 	UBT_NG_UNLOCK(sc);