diff --git a/src/hci.c b/src/hci.c
index 5a42d38f1..0e9780848 100644
--- a/src/hci.c
+++ b/src/hci.c
@@ -585,9 +585,6 @@ void hci_init(hci_transport_t *transport, void *config, bt_control_t *control, r
     hci_stack.connections = NULL;
     hci_stack.discoverable = 0;
     
-    // empty cmd buffer
-    hci_stack.hci_cmd_buffer = malloc(3+255);
-
     // higher level handler
     hci_stack.packet_handler = dummy_handler;
 
@@ -1087,10 +1084,9 @@ int hci_send_cmd_packet(uint8_t *packet, int size){
 int hci_send_cmd(const hci_cmd_t *cmd, ...){
     va_list argptr;
     va_start(argptr, cmd);
-    uint8_t * hci_cmd_buffer = hci_stack.hci_cmd_buffer;
     uint16_t size = hci_create_cmd_internal(hci_stack.hci_cmd_buffer, cmd, argptr);
     va_end(argptr);
-    return hci_send_cmd_packet(hci_cmd_buffer, size);
+    return hci_send_cmd_packet(hci_stack.hci_cmd_buffer, size);
 }
 
 // Create various non-HCI events. 
diff --git a/src/hci.h b/src/hci.h
index 838ff377a..ec830d000 100644
--- a/src/hci.h
+++ b/src/hci.h
@@ -226,7 +226,7 @@ typedef struct {
     linked_list_t     connections;
 
     // single buffer for HCI Command assembly
-    uint8_t          * hci_cmd_buffer;
+    uint8_t          hci_cmd_buffer[3+255]; // opcode (16), len(8)
     
     /* host to controller flow control */
     uint8_t  num_cmd_packets;