diff --git a/hw/usb/redirect.c b/hw/usb/redirect.c
index 3cf82589ede2644666ec15e612955425af7c3dc6..71f3594f4a0043953da1d2adabdec7f429b8b405 100644
--- a/hw/usb/redirect.c
+++ b/hw/usb/redirect.c
@@ -468,7 +468,7 @@ static int bufp_alloc(USBRedirDevice *dev, uint8_t *data, uint16_t len,
     if (dev->endpoint[EP2I(ep)].bufpq_dropping_packets) {
         if (dev->endpoint[EP2I(ep)].bufpq_size >
                 dev->endpoint[EP2I(ep)].bufpq_target_size) {
-            free(data);
+            free(free_on_destroy);
             return -1;
         }
         dev->endpoint[EP2I(ep)].bufpq_dropping_packets = 0;