diff --git a/openbsc/include/openbsc/gsm_data.h b/openbsc/include/openbsc/gsm_data.h
index a4c6fbc..d7db887 100644
--- a/openbsc/include/openbsc/gsm_data.h
+++ b/openbsc/include/openbsc/gsm_data.h
@@ -8,6 +8,9 @@
 
 #include <openbsc/rest_octets.h>
 
+/** annotations for msgb ownership */
+#define __uses
+
 #define OBSC_NM_W_ACK_CB(__msgb) (__msgb)->cb[3]
 
 struct mncc_sock_state;
diff --git a/openbsc/src/libmsc/smpp_smsc.c b/openbsc/src/libmsc/smpp_smsc.c
index f9e517b..aaf8521 100644
--- a/openbsc/src/libmsc/smpp_smsc.c
+++ b/openbsc/src/libmsc/smpp_smsc.c
@@ -40,6 +40,7 @@
 #include "smpp_smsc.h"
 
 #include <openbsc/debug.h>
+#include <openbsc/gsm_data.h>
 
 /*! \brief Ugly wrapper. libsmpp34 should do this itself! */
 #define SMPP34_UNPACK(rc, type, str, data, len)		\
@@ -718,7 +719,7 @@
 }
 
 /*! \brief one complete SMPP PDU from the ESME has been received */
-static int smpp_pdu_rx(struct osmo_esme *esme, struct msgb *msg)
+static int smpp_pdu_rx(struct osmo_esme *esme, struct msgb *msg __uses)
 {
 	uint32_t cmd_id = smpp_msgb_cmdid(msg);
 	int rc = 0;
@@ -822,6 +823,7 @@
 
 		if (esme->read_idx >= esme->read_len) {
 			rc = smpp_pdu_rx(esme, esme->read_msg);
+			msgb_free(esme->read_msg);
 			esme->read_msg = NULL;
 			esme->read_idx = 0;
 			esme->read_len = 0;