- int retval = 0;
- struct ofpbuf *next = rc->txq.head->next;
- struct rconn_packet_counter *counter = rc->txq.head->private_p;
- retval = vconn_send(rc->vconn, rc->txq.head);
+ struct ofpbuf *msg = ofpbuf_from_list(rc->txq.next);
+ struct rconn_packet_counter *counter = msg->private_p;
+ int retval;
+
+ /* Eagerly remove 'msg' from the txq. We can't remove it from the list
+ * after sending, if sending is successful, because it is then owned by the
+ * vconn, which might have freed it already. */
+ list_remove(&msg->list_node);
+
+ retval = vconn_send(rc->vconn, msg);