diff --git a/hw/usb/redirect.c b/hw/usb/redirect.c
index 998fc6e4b0053e9ccfdb4921d8e2aaa7d7cdbc83..87338f76da64e1af5843549ddb7c6cc84bab07b5 100644
--- a/hw/usb/redirect.c
+++ b/hw/usb/redirect.c
@@ -459,7 +459,7 @@ static int bufp_alloc(USBRedirDevice *dev, uint8_t *data, uint16_t len,
     if (dev->endpoint[EP2I(ep)].bufpq_dropping_packets) {
         if (dev->endpoint[EP2I(ep)].bufpq_size >
                 dev->endpoint[EP2I(ep)].bufpq_target_size) {
-            free(data);
+            free(free_on_destroy);
             return -1;
         }
         dev->endpoint[EP2I(ep)].bufpq_dropping_packets = 0;