diff --git a/src/netif/ppp/chap-new.c b/src/netif/ppp/chap-new.c
index 2d05d87d..6701b2fe 100644
--- a/src/netif/ppp/chap-new.c
+++ b/src/netif/ppp/chap-new.c
@@ -281,6 +281,7 @@ static void  chap_handle_response(ppp_pcb *pcb, int id,
 		     unsigned char *pkt, int len) {
 	int response_len, ok, mlen;
 	unsigned char *response, *outp;
+	struct pbuf *p;
 	char *name = NULL;	/* initialized to shut gcc up */
 	int (*verifier)(char *, char *, int, struct chap_digest_type *,
 		unsigned char *, unsigned char *, char *, int);
diff --git a/src/netif/ppp/eap.c b/src/netif/ppp/eap.c
index 7fb3ed64..0b1088ee 100644
--- a/src/netif/ppp/eap.c
+++ b/src/netif/ppp/eap.c
@@ -260,10 +260,15 @@ eap_send_failure(esp)
 eap_state *esp;
 {
 	ppp_pcb *pcb = &ppp_pcb_list[pcb->eap.es_unit];
+	struct pbuf *p;
 	u_char *outp;
 
-	outp = pcb->outpacket_buf;
-    
+	p = pbuf_alloc(PBUF_RAW, (u16_t)(PPP_HDRLEN + EAP_HEADERLEN), PBUF_RAM);
+	if(NULL == p)
+		return;
+
+	outp = p->payload;
+
 	MAKEHEADER(outp, PPP_EAP);
 
 	PUTCHAR(EAP_FAILURE, outp);
@@ -271,7 +276,7 @@ eap_state *esp;
 	PUTCHAR(pcb->eap.es_server.ea_id, outp);
 	PUTSHORT(EAP_HEADERLEN, outp);
 
-	ppp_write(pcb, pcb->outpacket_buf, EAP_HEADERLEN + PPP_HDRLEN);
+	ppp_write_pbuf(pcb, p);
 
 	pcb->eap.es_server.ea_state = eapBadAuth;
 	auth_peer_fail(pcb, PPP_EAP);
@@ -286,9 +291,14 @@ eap_send_success(esp)
 eap_state *esp;
 {
 	ppp_pcb *pcb = &ppp_pcb_list[pcb->eap.es_unit];
+	struct pbuf *p;
 	u_char *outp;
 
-	outp = pcb->outpacket_buf;
+	p = pbuf_alloc(PBUF_RAW, (u16_t)(PPP_HDRLEN + EAP_HEADERLEN), PBUF_RAM);
+	if(NULL == p)
+		return;
+
+	outp = p->payload;
     
 	MAKEHEADER(outp, PPP_EAP);
 
@@ -297,7 +307,7 @@ eap_state *esp;
 	PUTCHAR(pcb->eap.es_server.ea_id, outp);
 	PUTSHORT(EAP_HEADERLEN, outp);
 
-	ppp_write(pcb, pcb->outpacket_buf, PPP_HDRLEN + EAP_HEADERLEN);
+	ppp_write_pbuf(pcb, p);
 
 	auth_peer_success(pcb, PPP_EAP, 0,
 	    pcb->eap.es_server.ea_peer, pcb->eap.es_server.ea_peerlen);
@@ -642,6 +652,7 @@ eap_send_request(esp)
 eap_state *esp;
 {
 	ppp_pcb *pcb = &ppp_pcb_list[pcb->eap.es_unit];
+	struct pbuf *p;
 	u_char *outp;
 	u_char *lenloc;
 	u_char *ptr;
@@ -682,7 +693,12 @@ eap_state *esp;
 		return;
 	}
 
-	outp = pcb->outpacket_buf;
+	/* FIXME: improve buffer size */
+	p = pbuf_alloc(PBUF_RAW, (u16_t)(PPP_MRU+PPP_HDRLEN), PBUF_RAM);
+	if(NULL == p)
+		return;
+
+	outp = p->payload;
     
 	MAKEHEADER(outp, PPP_EAP);
 
@@ -858,10 +874,11 @@ eap_state *esp;
 		return;
 	}
 
-	outlen = (outp - pcb->outpacket_buf) - PPP_HDRLEN;
+	outlen = (outp - p->payload) - PPP_HDRLEN;
 	PUTSHORT(outlen, lenloc);
 
-	ppp_write(pcb, pcb->outpacket_buf, outlen + PPP_HDRLEN);
+	pbuf_realloc(p, outlen + PPP_HDRLEN);
+	ppp_write_pbuf(pcb, p);
 
 	pcb->eap.es_server.ea_requests++;
 
@@ -1034,42 +1051,52 @@ static void eap_protrej(ppp_pcb *pcb) {
  * Format and send a regular EAP Response message.
  */
 static void eap_send_response(ppp_pcb *pcb, u_char id, u_char typenum, u_char *str, int lenstr) {
+	struct pbuf *p;
 	u_char *outp;
 	int msglen;
 
-	outp = pcb->outpacket_buf;
+	msglen = EAP_HEADERLEN + sizeof (u_char) + lenstr;
+	p = pbuf_alloc(PBUF_RAW, (u16_t)(PPP_HDRLEN + msglen), PBUF_RAM);
+	if(NULL == p)
+		return;
+
+	outp = p->payload;
 
 	MAKEHEADER(outp, PPP_EAP);
 
 	PUTCHAR(EAP_RESPONSE, outp);
 	PUTCHAR(id, outp);
 	pcb->eap.es_client.ea_id = id;
-	msglen = EAP_HEADERLEN + sizeof (u_char) + lenstr;
 	PUTSHORT(msglen, outp);
 	PUTCHAR(typenum, outp);
 	if (lenstr > 0) {
 		MEMCPY(outp, str, lenstr);
 	}
 
-	ppp_write(pcb, pcb->outpacket_buf, PPP_HDRLEN + msglen);
+	ppp_write_pbuf(pcb, p);
 }
 
 /*
  * Format and send an MD5-Challenge EAP Response message.
  */
 static void eap_chap_response(ppp_pcb *pcb, u_char id, u_char *hash, char *name, int namelen) {
+	struct pbuf *p;
 	u_char *outp;
 	int msglen;
 
-	outp = pcb->outpacket_buf;
+	msglen = EAP_HEADERLEN + 2 * sizeof (u_char) + MD5_SIGNATURE_SIZE +
+	    namelen;
+	p = pbuf_alloc(PBUF_RAW, (u16_t)(PPP_HDRLEN + msglen), PBUF_RAM);
+	if(NULL == p)
+		return;
+
+	outp = p->payload;
     
 	MAKEHEADER(outp, PPP_EAP);
 
 	PUTCHAR(EAP_RESPONSE, outp);
 	PUTCHAR(id, outp);
 	pcb->eap.es_client.ea_id = id;
-	msglen = EAP_HEADERLEN + 2 * sizeof (u_char) + MD5_SIGNATURE_SIZE +
-	    namelen;
 	PUTSHORT(msglen, outp);
 	PUTCHAR(EAPT_MD5CHAP, outp);
 	PUTCHAR(MD5_SIGNATURE_SIZE, outp);
@@ -1079,7 +1106,7 @@ static void eap_chap_response(ppp_pcb *pcb, u_char id, u_char *hash, char *name,
 		MEMCPY(outp, name, namelen);
 	}
 
-	ppp_write(pcb, pcb->outpacket_buf, PPP_HDRLEN + msglen);
+	ppp_write_pbuf(pcb, p);
 }
 
 #ifdef USE_SRP
@@ -1095,17 +1122,22 @@ u_char *str;
 int lenstr;
 {
 	ppp_pcb *pcb = &ppp_pcb_list[pcb->eap.es_unit];
+	struct pbuf *p;
 	u_char *outp;
 	int msglen;
 
-	outp = pcb->outpacket_buf;
+	msglen = EAP_HEADERLEN + 2 * sizeof (u_char) + lenstr;
+	p = pbuf_alloc(PBUF_RAW, (u16_t)(PPP_HDRLEN + msglen), PBUF_RAM);
+	if(NULL == p)
+		return;
+
+	outp = p->payload;
 
 	MAKEHEADER(outp, PPP_EAP);
 
 	PUTCHAR(EAP_RESPONSE, outp);
 	PUTCHAR(id, outp);
 	pcb->eap.es_client.ea_id = id;
-	msglen = EAP_HEADERLEN + 2 * sizeof (u_char) + lenstr;
 	PUTSHORT(msglen, outp);
 	PUTCHAR(EAPT_SRP, outp);
 	PUTCHAR(subtypenum, outp);
@@ -1113,7 +1145,7 @@ int lenstr;
 		MEMCPY(outp, str, lenstr);
 	}
 
-	ppp_write(pcb, pcb->outpacket_buf, PPP_HDRLEN + msglen);
+	ppp_write_pbuf(pcb, p);
 }
 
 /*
@@ -1127,45 +1159,55 @@ u_int32_t flags;
 u_char *str;
 {
 	ppp_pcb *pcb = &ppp_pcb_list[pcb->eap.es_unit];
+	struct pbuf *p;
 	u_char *outp;
 	int msglen;
 
-	outp = pcb->outpacket_buf;
+	msglen = EAP_HEADERLEN + 2 * sizeof (u_char) + sizeof (u_int32_t) +
+	    SHA_DIGESTSIZE;
+	p = pbuf_alloc(PBUF_RAW, (u16_t)(PPP_HDRLEN + msglen), PBUF_RAM);
+	if(NULL == p)
+		return;
+
+	outp = p->payload;
 
 	MAKEHEADER(outp, PPP_EAP);
 
 	PUTCHAR(EAP_RESPONSE, outp);
 	PUTCHAR(id, outp);
 	pcb->eap.es_client.ea_id = id;
-	msglen = EAP_HEADERLEN + 2 * sizeof (u_char) + sizeof (u_int32_t) +
-	    SHA_DIGESTSIZE;
 	PUTSHORT(msglen, outp);
 	PUTCHAR(EAPT_SRP, outp);
 	PUTCHAR(EAPSRP_CVALIDATOR, outp);
 	PUTLONG(flags, outp);
 	MEMCPY(outp, str, SHA_DIGESTSIZE);
 
-	ppp_write(pcb, pcb->outpacket_buf, PPP_HDRLEN + msglen);
+	ppp_write_pbuf(pcb, p);
 }
 #endif /* USE_SRP */
 
 static void eap_send_nak(ppp_pcb *pcb, u_char id, u_char type) {
+	struct pbuf *p;
 	u_char *outp;
 	int msglen;
 
-	outp = pcb->outpacket_buf;
+	msglen = EAP_HEADERLEN + 2 * sizeof (u_char);
+	p = pbuf_alloc(PBUF_RAW, (u16_t)(PPP_HDRLEN + msglen), PBUF_RAM);
+	if(NULL == p)
+		return;
+
+	outp = p->payload;
 
 	MAKEHEADER(outp, PPP_EAP);
 
 	PUTCHAR(EAP_RESPONSE, outp);
 	PUTCHAR(id, outp);
 	pcb->eap.es_client.ea_id = id;
-	msglen = EAP_HEADERLEN + 2 * sizeof (u_char);
 	PUTSHORT(msglen, outp);
 	PUTCHAR(EAPT_NAK, outp);
 	PUTCHAR(type, outp);
 
-	ppp_write(pcb, pcb->outpacket_buf, PPP_HDRLEN + msglen);
+	ppp_write_pbuf(pcb, p);
 }
 
 #ifdef USE_SRP
diff --git a/src/netif/ppp/fsm.c b/src/netif/ppp/fsm.c
index fe5354c9..bde8965b 100644
--- a/src/netif/ppp/fsm.c
+++ b/src/netif/ppp/fsm.c
@@ -686,6 +686,7 @@ void fsm_protreject(fsm *f) {
  */
 static void fsm_sconfreq(fsm *f, int retransmit) {
     ppp_pcb *pcb = f->pcb;
+    struct pbuf *p;
     u_char *outp;
     int cilen;
 
@@ -705,10 +706,15 @@ static void fsm_sconfreq(fsm *f, int retransmit) {
 
     f->seen_ack = 0;
 
+    /* FIXME: improve buffer size */
+    p = pbuf_alloc(PBUF_RAW, (u16_t)(PPP_MRU+PPP_HDRLEN), PBUF_RAM);
+    if(NULL == p)
+        return;
+
     /*
      * Make up the request packet
      */
-    outp = pcb->outpacket_buf + PPP_HDRLEN + HEADERLEN;
+    outp = (u_char*)p->payload + PPP_HDRLEN + HEADERLEN;
     if( f->callbacks->cilen && f->callbacks->addci ){
 	cilen = (*f->callbacks->cilen)(f);
 	if( cilen > pcb->peer_mru - HEADERLEN )
@@ -719,7 +725,14 @@ static void fsm_sconfreq(fsm *f, int retransmit) {
 	cilen = 0;
 
     /* send the request to our peer */
-    fsm_sdata(f, CONFREQ, f->reqid, outp, cilen);
+    outp = p->payload;
+    MAKEHEADER(outp, f->protocol);
+    PUTCHAR(CONFREQ, outp);
+    PUTCHAR(f->reqid, outp);
+    PUTSHORT(cilen + HEADERLEN, outp);
+
+    pbuf_realloc(p, cilen + HEADERLEN + PPP_HDRLEN);
+    ppp_write_pbuf(pcb, p);
 
     /* start the retransmit timer */
     --f->retransmits;
@@ -734,21 +747,27 @@ static void fsm_sconfreq(fsm *f, int retransmit) {
  */
 void fsm_sdata(fsm *f, u_char code, u_char id, u_char *data, int datalen) {
     ppp_pcb *pcb = f->pcb;
+    struct pbuf *p;
     u_char *outp;
     int outlen;
 
     /* Adjust length to be smaller than MTU */
-    outp = pcb->outpacket_buf;
     if (datalen > pcb->peer_mru - HEADERLEN)
 	datalen = pcb->peer_mru - HEADERLEN;
-    if (datalen && data != outp + PPP_HDRLEN + HEADERLEN)
-	MEMCPY(outp + PPP_HDRLEN + HEADERLEN, data, datalen);
     outlen = datalen + HEADERLEN;
+
+    p = pbuf_alloc(PBUF_RAW, (u16_t)(outlen + PPP_HDRLEN), PBUF_RAM);
+    if(NULL == p)
+        return;
+
+    outp = p->payload;
+/*  if (datalen && data != outp + PPP_HDRLEN + HEADERLEN)  -- was only for fsm_sconfreq() */
+	MEMCPY(outp + PPP_HDRLEN + HEADERLEN, data, datalen);
     MAKEHEADER(outp, f->protocol);
     PUTCHAR(code, outp);
     PUTCHAR(id, outp);
     PUTSHORT(outlen, outp);
-    ppp_write(pcb, pcb->outpacket_buf, outlen + PPP_HDRLEN);
+    ppp_write_pbuf(pcb, p);
 }
 
 #endif /* PPP_SUPPORT */
diff --git a/src/netif/ppp/ppp.c b/src/netif/ppp/ppp.c
index 33e4d466..a1d41d6a 100644
--- a/src/netif/ppp/ppp.c
+++ b/src/netif/ppp/ppp.c
@@ -1146,6 +1146,7 @@ ppp_ioctl(ppp_pcb *pcb, int cmd, void *arg)
   return PPPERR_PARAM;
 }
 
+/* FIXME: improve that */
 int ppp_write_pbuf(ppp_pcb *pcb, struct pbuf *p) {
   ppp_write(pcb, p->payload, p->len);
   pbuf_free(p);
diff --git a/src/netif/ppp/ppp.h b/src/netif/ppp/ppp.h
index 513b3f47..ffd94ef1 100644
--- a/src/netif/ppp/ppp.h
+++ b/src/netif/ppp/ppp.h
@@ -345,13 +345,6 @@ struct ppp_pcb_s {
   int ipcp_is_open;             /* haven't called np_finished() */
   int ipcp_is_up;               /* have called np_up() */
   bool ask_for_local;           /* request our address from peer */
-
-  /*
-   * Buffers for outgoing packets.  This must be accessed only from the appropriate
-   * PPP task so that it doesn't need to be protected to avoid collisions.
-   */
-  u_char outpacket_buf[PPP_MRU+PPP_HDRLEN]; /* buffer for outgoing packet */
-
 };
 
 /************************
diff --git a/src/netif/ppp/ppp_impl.h b/src/netif/ppp/ppp_impl.h
index 23126cdf..0a487f13 100644
--- a/src/netif/ppp/ppp_impl.h
+++ b/src/netif/ppp/ppp_impl.h
@@ -235,8 +235,6 @@ struct ppp_idle {
 /*
  * Global variables.
  */
-extern u_char	outpacket_buf[]; /* Buffer for outgoing packets */
-
 #ifdef HAVE_MULTILINK
 extern bool	multilink;	/* enable multilink operation */
 extern bool	doing_multilink;