Index: sys/dev/mpr/mpr_sas.c
===================================================================
--- sys/dev/mpr/mpr_sas.c
+++ sys/dev/mpr/mpr_sas.c
@@ -1169,6 +1169,12 @@
 		cm->cm_reply = NULL;
 		completed = 0;
 
+		if (cm->cm_flags & MPR_CM_FLAGS_SATA_ID_TIMEOUT) {
+			MPASS(cm->cm_data);
+			free(cm->cm_data, M_MPR);
+			cm->cm_data = NULL;
+		}
+
 		if (cm->cm_flags & MPR_CM_FLAGS_POLLED)
 			cm->cm_flags |= MPR_CM_FLAGS_COMPLETE;
 
Index: sys/dev/mpr/mpr_sas_lsi.c
===================================================================
--- sys/dev/mpr/mpr_sas_lsi.c
+++ sys/dev/mpr/mpr_sas_lsi.c
@@ -1026,6 +1026,7 @@
 	for (i = 1; i < sc->num_reqs; i++) {
 		cm = &sc->commands[i];
 		if (cm->cm_flags & MPR_CM_FLAGS_SATA_ID_TIMEOUT) {
+			free(cm->cm_data, M_MPR);
 			mpr_free_command(sc, cm);
 		}
 	}
@@ -1208,15 +1209,14 @@
 out:
 	/*
 	 * If the SATA_ID_TIMEOUT flag has been set for this command, don't free
-	 * it.  The command will be freed after sending a target reset TM. If
-	 * the command did timeout, use EWOULDBLOCK.
+	 * it.  The command and buffer will be freed after sending an Abort
+	 * Task TM.  If the command did timeout, use EWOULDBLOCK.
 	 */
-	if ((cm->cm_flags & MPR_CM_FLAGS_SATA_ID_TIMEOUT) == 0)
+	if ((cm->cm_flags & MPR_CM_FLAGS_SATA_ID_TIMEOUT) == 0) {
 		mpr_free_command(sc, cm);
-	else if (error == 0)
+		free(buffer, M_MPR);
+	} else if (error == 0)
 		error = EWOULDBLOCK;
-	cm->cm_data = NULL;
-	free(buffer, M_MPR);
 	return (error);
 }
 
Index: sys/dev/mps/mps_sas.c
===================================================================
--- sys/dev/mps/mps_sas.c
+++ sys/dev/mps/mps_sas.c
@@ -1108,6 +1108,12 @@
 		cm->cm_reply = NULL;
 		completed = 0;
 
+		if (cm->cm_flags & MPS_CM_FLAGS_SATA_ID_TIMEOUT) {
+			MPASS(cm->cm_data);
+			free(cm->cm_data, M_MPT2);
+			cm->cm_data = NULL;
+		}
+
 		if (cm->cm_flags & MPS_CM_FLAGS_POLLED)
 			cm->cm_flags |= MPS_CM_FLAGS_COMPLETE;
 
Index: sys/dev/mps/mps_sas_lsi.c
===================================================================
--- sys/dev/mps/mps_sas_lsi.c
+++ sys/dev/mps/mps_sas_lsi.c
@@ -818,6 +818,7 @@
 	for (i = 1; i < sc->num_reqs; i++) {
 		cm = &sc->commands[i];
 		if (cm->cm_flags & MPS_CM_FLAGS_SATA_ID_TIMEOUT) {
+			free(cm->cm_data, M_MPT2);
 			mps_free_command(sc, cm);
 		}
 	}
@@ -1000,15 +1001,15 @@
 out:
 	/*
 	 * If the SATA_ID_TIMEOUT flag has been set for this command, don't free
-	 * it.  The command will be freed after sending a target reset TM. If
-	 * the command did timeout, use EWOULDBLOCK.
+	 * it.  The command and buffer will be freed after sending an Abort
+	 * Task TM.  If the command did timeout, use EWOULDBLOCK.
 	 */
 	if ((cm != NULL)
-	 && (cm->cm_flags & MPS_CM_FLAGS_SATA_ID_TIMEOUT) == 0)
+	    && (cm->cm_flags & MPS_CM_FLAGS_SATA_ID_TIMEOUT) == 0) {
 		mps_free_command(sc, cm);
-	else if (error == 0)
+		free(buffer, M_MPT2);
+	} else if (error == 0)
 		error = EWOULDBLOCK;
-	free(buffer, M_MPT2);
 	return (error);
 }