From 9d2b32e9f83f6924927785b181b54f6b746f853e Mon Sep 17 00:00:00 2001
From: Juliusz Sosinowicz <juliusz@wolfssl.com>
Date: Thu, 23 Jul 2026 10:40:31 +0000
Subject: [PATCH] DTLS: clear dtls_tx_msg cursor when its record is freed

---
 src/internal.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/src/internal.c b/src/internal.c
index 5914aa4203..ccd411603a 100644
--- a/src/internal.c
+++ b/src/internal.c
@@ -9926,8 +9926,11 @@ void DtlsTxMsgListClean(WOLFSSL* ssl)
     WOLFSSL_ENTER("DtlsTxMsgListClean");
     while (head) {
         next = head->next;
-        if (VerifyForTxDtlsMsgDelete(ssl, head))
+        if (VerifyForTxDtlsMsgDelete(ssl, head)) {
+            if (ssl->dtls_tx_msg == head)
+                ssl->dtls_tx_msg = NULL;
             DtlsMsgDelete(head, ssl->heap);
+        }
         else
             /* Stored packets should be in order so break on first failed
              * verify */