STATUS_BLOCK_SBP_STATUS(
                                                SBP_STATUS_REQ_TYPE_NOTSUPP));
                        sbp_send_status(req);
-                       sbp_free_request(req);
                        return;
                case 3: /* Dummy ORB */
                        req->status.status |= cpu_to_be32(
                                        STATUS_BLOCK_SBP_STATUS(
                                                SBP_STATUS_DUMMY_ORB_COMPLETE));
                        sbp_send_status(req);
-                       sbp_free_request(req);
                        return;
                default:
                        BUG();
                        spin_unlock_bh(&agent->lock);
 
                        sbp_send_status(req);
-                       sbp_free_request(req);
                        return;
                }
 
        req->se_cmd.tag = req->orb_pointer;
        if (target_submit_cmd(&req->se_cmd, sess->se_sess, req->cmd_buf,
                              req->sense_buf, unpacked_lun, data_length,
-                             TCM_SIMPLE_TAG, data_dir, 0))
+                             TCM_SIMPLE_TAG, data_dir, TARGET_SCF_ACK_KREF))
                goto err;
 
        return;
                STATUS_BLOCK_LEN(1) |
                STATUS_BLOCK_SBP_STATUS(SBP_STATUS_UNSPECIFIED_ERROR));
        sbp_send_status(req);
-       sbp_free_request(req);
 }
 
 /*
 
 static int sbp_send_status(struct sbp_target_request *req)
 {
-       int ret, length;
+       int rc, ret = 0, length;
        struct sbp_login_descriptor *login = req->login;
 
        length = (((be32_to_cpu(req->status.status) >> 24) & 0x07) + 1) * 4;
 
-       ret = sbp_run_request_transaction(req, TCODE_WRITE_BLOCK_REQUEST,
+       rc = sbp_run_request_transaction(req, TCODE_WRITE_BLOCK_REQUEST,
                        login->status_fifo_addr, &req->status, length);
-       if (ret != RCODE_COMPLETE) {
-               pr_debug("sbp_send_status: write failed: 0x%x\n", ret);
-               return -EIO;
+       if (rc != RCODE_COMPLETE) {
+               pr_debug("sbp_send_status: write failed: 0x%x\n", rc);
+               ret = -EIO;
+               goto put_ref;
        }
 
        pr_debug("sbp_send_status: status write complete for ORB: 0x%llx\n",
                        req->orb_pointer);
-
-       return 0;
+       /*
+        * Drop the extra ACK_KREF reference taken by target_submit_cmd()
+        * ahead of sbp_check_stop_free() -> transport_generic_free_cmd()
+        * final se_cmd->cmd_kref put.
+        */
+put_ref:
+       target_put_sess_cmd(&req->se_cmd);
+       return ret;
 }
 
 static void sbp_sense_mangle(struct sbp_target_request *req)
        struct sbp_target_request *req = container_of(se_cmd,
                        struct sbp_target_request, se_cmd);
 
-       transport_generic_free_cmd(&req->se_cmd, 0);
-       return 1;
+       return transport_generic_free_cmd(&req->se_cmd, 0);
 }
 
 static int sbp_count_se_tpg_luns(struct se_portal_group *tpg)