diff --git a/examples/device/net_lwip_webserver/src/main.c b/examples/device/net_lwip_webserver/src/main.c
index 791e09b4f..529b51d71 100644
--- a/examples/device/net_lwip_webserver/src/main.c
+++ b/examples/device/net_lwip_webserver/src/main.c
@@ -194,8 +194,13 @@ uint16_t tud_network_xmit_cb(uint8_t *dst, void *ref, uint16_t arg) {
 static void service_traffic(void) {
   /* handle any packet received by tud_network_recv_cb() */
   if (received_frame) {
-    ethernet_input(received_frame, &netif_data);
-    pbuf_free(received_frame);
+    // Surrender ownership of our pbuf unless there was an error
+    // Only call pbuf_free if not Ok else it will panic with "pbuf_free: p->ref > 0"
+    // or steal it from whatever took ownership of it with undefined consequences.
+    // See: https://savannah.nongnu.org/patch/index.php?10121
+    if (ethernet_input(received_frame, &netif_data)!=ERR_OK) {
+        pbuf_free(received_frame);
+    }
     received_frame = NULL;
     tud_network_recv_renew();
   }