diff --git a/src/gsm/lapd_core.c b/src/gsm/lapd_core.c
index 68b5e78..f7cefbe 100644
--- a/src/gsm/lapd_core.c
+++ b/src/gsm/lapd_core.c
@@ -1950,7 +1950,7 @@ static int lapd_res_req(struct osmo_dlsap_prim *dp, struct lapd_msg_ctx *lctx)
 	struct lapd_msg_ctx nctx;
 
 	LOGP(DLLAPD, LOGL_INFO, "perform re-establishment (SABM) length=%d\n",
-		msg->len);
+		(msg) ? msg->len : 0);
 	
 	/* be sure that history is empty */
 	lapd_dl_flush_hist(dl);
@@ -1962,11 +1962,14 @@ static int lapd_res_req(struct osmo_dlsap_prim *dp, struct lapd_msg_ctx *lctx)
 	if (dl->send_buffer)
 		msgb_free(dl->send_buffer);
 	dl->send_out = 0;
-	if (msg && msg->len)
+	if (msg && msg->len) {
 		/* Write data into the send buffer, to be sent first */
 		dl->send_buffer = msg;
-	else
+	} else {
+		if (msg)
+			msgb_free(msg);
 		dl->send_buffer = NULL;
+	}
 
 	/* Discard partly received L3 message */
 	if (dl->rcv_buffer) {