diff --git a/components/wpa_supplicant/esp_supplicant/src/esp_wps.c b/components/wpa_supplicant/esp_supplicant/src/esp_wps.c
index a42223572b2..6697f8d3208 100644
--- a/components/wpa_supplicant/esp_supplicant/src/esp_wps.c
+++ b/components/wpa_supplicant/esp_supplicant/src/esp_wps.c
@@ -483,7 +483,6 @@ static int wps_eap_wsc_prepare_rx_buf(struct wps_sm *sm,
     }
 
     wpabuf_set(tmpbuf, buf, len);
-    frag->in_buf = tmpbuf;
     return ESP_OK;
 
 fail:
@@ -515,6 +514,7 @@ static int wps_process_wps_mX_req(u8 *ubuf, int len, enum wps_process_res *res)
     u16 message_length = 0;
     bool fragment_pending;
     struct wpabuf tmpbuf;
+    struct wpabuf *msg_buf;
 
     if (!sm || !res) {
         return ESP_FAIL;
@@ -579,8 +579,9 @@ static int wps_process_wps_mX_req(u8 *ubuf, int len, enum wps_process_res *res)
     }
 
     eloop_cancel_timeout(wifi_station_wps_msg_timeout, NULL, NULL);
+    msg_buf = frag->in_buf ? frag->in_buf : &tmpbuf;
 
-    *res = wps_enrollee_process_msg(sm->wps, expd->opcode, frag->in_buf);
+    *res = wps_enrollee_process_msg(sm->wps, expd->opcode, msg_buf);
 
     if (*res == WPS_CONTINUE && sm->wps->state == WPS_MSG_DONE) {
         wpa_printf(MSG_DEBUG, "WPS: M8 processed, starting workaround timer");
@@ -593,9 +594,7 @@ static int wps_process_wps_mX_req(u8 *ubuf, int len, enum wps_process_res *res)
         sm->state = WPA_FAIL;
     }
 
-    if (frag->in_buf != &tmpbuf) {
-        wpabuf_free(frag->in_buf);
-    }
+    wpabuf_free(frag->in_buf);
     frag->in_buf = NULL;
     return ESP_OK;
 }